The vulnerability allows code executed within the VM.run() context to obtain a reference to the host process object and invoke arbitrary host commands without any host side‑by‑side cooperation. This results in a full escape from the intended sandbox, giving an attacker the same privileges as the Node.js process, which can lead to compromise of the entire host system.

The affected component is patriksimek's vm2 JavaScript sandbox library for Node.js. Version 3.10.4 is vulnerable; the issue was addressed and fixed in version 3.10.5. No specific Node.js runtime version is mentioned in the advisory, although the title references Node 25.

The vulnerability carries a CVSS score of 9.8, indicating critical severity. EPSS data indicates a very low but nonzero exploitation probability, and the lack of a KEV listing suggests exploitation has not yet been observed in the wild. The likely attack vector involves an attacker supplying malicious content to the VM.run() method, which can obtain a host process handle and execute arbitrary system commands rooted in the Node.js runtime.