The vm2 npm package versions 3.12.0 and earlier have a sandbox escape vulnerability involving the handling of host-realm Promises. The rejection sanitizer in lib/bridge.js only wraps rejection handlers that are functions and applies neutralization only to the sandbox intrinsic Promise.prototype, not to host Promises. This allows sandboxed code to overwrite p.constructor[Symbol.species] on a host Promise and call p.then() without an onRejected handler, causing V8 to throw the raw host rejection value into a closure controlled by the attacker. This bypasses handleException and hostPromiseSanitizeReject, delivering an unsanitized, fully functional bridge proxy of the host object to sandboxed code. If the rejection value is host-pivotable (e.g., the host process object), this can lead to arbitrary code execution on the host. The issue is fixed in vm2 version 3.12.1.

Successful exploitation allows sandboxed code to escape the vm2 sandbox and execute arbitrary code on the host system by obtaining unsanitized access to host objects through manipulated host Promises. This represents a critical security risk as it breaks the fundamental isolation guarantees of vm2.

Upgrade vm2 to version 3.12.1 or later, where this sandbox escape vulnerability is fixed. No other mitigations are indicated by the vendor advisory.