The vulnerability resides in vm2’s handling of the Promise constructor. When sandboxed code creates a Promise, an unhandled rejection propagates to the host Node.js process, causing it to crash. The flaw is a classic example of an unhandled exception (CWE‑248) that yields a critical denial‑of‑service condition for the hosting application.

The affected product is vm2 from patriksimek. All releases prior to version 3.11.0, including v3.10.5, are susceptible. The issue is resolved in v3.11.0 and later.

The CVSS score of 8.6 reflects a high‑severity impact, though the EPSS score is unavailable. The vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploits as of the last assessment. Exploitation requires the ability to run arbitrary sandboxed code; an attacker controlling such code can induce a host process crash. This creates an opportunity for a denial‑of‑service attack against any application that relies on vm2 to contain untrusted code.