The vulnerability is a sandbox escape flaw in vm2, an open‑source Node.js virtual machine. SuppressedError objects can be exploited to break out of the isolated environment, allowing an attacker to execute arbitrary code with the same privileges as the host process. This represents a critical integrity and confidentiality breach. The weakness is rooted in improper error handling and code injection controls (CWE-693, CWE-94).

The affected product is Patriksimek’s vm2 library, and any deployment that uses a version older than 3.11.0 is susceptible. The issue exists across all builds of vm2 released before the 3.11.0 patch, regardless of Node.js runtime version. Systems that embed vm2 for sandboxing external or untrusted code should investigate their current library version.

The CVSS base score of 9.8 signals an extremely severe risk. Although no EPSS score is published, the absence of a numeric value does not diminish the high likelihood that a determined attacker who can control or influence the vm2 input will succeed. The vulnerability is not yet recorded in CISA’s KEV catalog, indicating no widespread exploitation has been confirmed, yet the combination of a high severity rating and the ability to run arbitrary code makes it a priority target for attackers. A likely attack vector involves supplying crafted code that triggers a SuppressedError during vm2 execution, leading to sandbox escape and code execution in the host context.