The vulnerability in vm2 allows a sandboxed script to bypass a performance optimization that normally performs an AST analysis step. By omitting catch, import, and async statements, the fast‑path bypass grants direct access to the internal variable VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL, which holds critical internal functions such as handleException, wrapWith, and import. This exposure can enable an attacker to manipulate the sandbox’s exception handling or import logic, potentially leading to privileged code execution within the sandbox environment. The weakness corresponds to CWE‑693 for failure to restrict operations to authorized users.

The affected product is vm2, an open‑source virtual machine/sandbox for Node.js, from vendor patriksimek. All releases prior to version 3.11.0 are vulnerable; versions 3.11.0 and later contain the fix.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely an attacker running arbitrary JavaScript code inside the vulnerable vm2 sandbox, exploiting the fast‑path bypass by writing code that omits catch, import, or async keywords. By doing so, the attacker can read or alter critical internal functions without triggering the normal security checks.