vm2 is an open‑source virtual machine and sandbox for Node.js. Versions earlier than 3.11.2 contain a sandbox breakout vulnerability that permits code running within vm2 to escape the sandbox and execute arbitrary commands on the host system. This flaw is mapped to CWE‑668 (Privilege Escalation) and CWE‑653 (Failure to Make Use of a Secret as Intended), evidencing bypass of the intended isolation boundaries and improper handling of internal data.

Affected products include the patriksimek:vm2 library for Node.js, in all releases older than 3.11.2. Applications that embed this library and run untrusted code within vm2 are at risk. Any deployment that depends on an older version without applying the update is considered vulnerable.

The CVSS base score of 9.8 indicates critical severity, reflecting the full compromise of the host process. The EPSS score is noted as < 1%, indicating a low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is local or within the Node.js environment; an attacker who can supply malicious input consumed by vm2 can trigger the sandbox escape, allowing execution of arbitrary commands with the privileges of the hosting Node.js process.