The vulnerability in vm2 versions before 3.11.7 arises from improper privilege management in the builtin-module denylist feature of NodeVM. When the embedder configures require with a builtin wildcard and negative entries (e.g., require: { builtin: ['*', '-fs', '-child_process'] }), the negative entries only match exact module names and do not block subpaths like fs/promises. Consequently, sandboxed code can bypass restrictions by requiring submodules such as 'fs/promises' or 'node:fs/promises', gaining access to promise-based filesystem operations. This allows sandboxed code to perform file system writes and other operations that should have been denied. The vendor fixed this issue in vm2 version 3.11.7.

Sandboxed code can bypass module denylist restrictions to access and use promise-based filesystem APIs, enabling unauthorized file creation, modification, and other filesystem operations. This breaks the intended security isolation of the sandbox environment, potentially leading to privilege escalation or unauthorized data manipulation.

Upgrade to vm2 version 3.11.7 or later, where this builtin-module denylist bypass is fixed. No other mitigation is required as the vendor has provided an official fix.