The vulnerability in vm2 versions >=3.11.0 <3.11.8 involves improper control of dynamically-managed code resources. Specifically, the sandbox fails to protect host TypedArray and ArrayBuffer prototypes from mutation by sandboxed code. Attackers can exploit prototype-walking primitives to access and alter host Uint8Array.prototype, %TypedArray%.prototype, and ArrayBuffer.prototype. As a result, typed arrays created by the host after VM.run() returns may exhibit attacker-controlled properties, undermining sandbox isolation.

Successful exploitation allows attacker-controlled code within the sandbox to modify host environment prototypes related to typed arrays. This breaks the isolation guarantees of the vm2 sandbox, potentially leading to arbitrary code execution or data manipulation in the host environment. The CVSS 4.0 score of 9.3 reflects the high severity and ease of exploitation without privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users of vm2 should monitor official patriksimek advisories for updates and apply any released patches promptly. Until a fix is available, avoid running untrusted code in affected vm2 versions or implement additional sandboxing controls externally.