vm2 is an open source sandbox for Node.js that relies on a function called neutralizeArraySpeciesBatch to isolate array behavior. In versions before 3.11.2 the method can pick up objects from the surrounding environment and, through a getter on the array prototype, expose host objects back into the VM. An attacker who can inject code into the VM can therefore obtain the host Function object and execute arbitrary code on the underlying system. This is a classic container escape that directly compromises confidentiality, integrity and availability of the host.

The library patriksimek:vm2 is affected when its installed version is older than 3.11.2. All releases prior to 3.11.2 contain the susceptible implementation of neutralizeArraySpeciesBatch and therefore allow the described escape.

The vulnerability has a CVSS score of 9.8, reflecting a high exploitation potential. The EPSS score is not available, but the lack of a listing in the CISA KEV catalog does not mitigate the severity. An attacker must first be able to execute code inside the vm2 sandbox – a scenario common in untrusted package execution or compromised build pipelines – and then invoke the vulnerable method to break out. If achieved, the attacker can run host commands with the privileges of the Node.js process.