vm2 is an open‑source virtual machine and sandbox for Node.js. Versions prior to 3.11.2 are affected by a sandbox breakout vulnerability. An error caused by a null prototype reference allows code executing inside a vm2 sandbox to escape the isolation boundary and run arbitrary instructions with the privileges of the hosting Node.js process. The vulnerability maps to CWE‑668 (Privilege Escalation) and CWE‑653 (Failure to Make Use of a Secret as Intended), indicating that the exploit both bypasses intended access controls and misuses internal data that should remain private. This results in potential compromise of confidentiality, integrity, and availability of the host application.

Affected products include the patriksimek:vm2 library for Node.js, in all releases older than 3.11.2. Applications that embed this library and run untrusted code within vm2 are at risk. Any deployment that depends on an older version without applying the update is considered vulnerable.

The CVSS base score of 9.8 indicates critical severity, reflecting the full compromise of the host process. The EPSS score is noted as < 1%, indicating a low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is local or within the Node.js environment; an attacker who can supply malicious input consumed by vm2 can trigger the null prototype exception, leveraging the weakness in CWE‑668 and CWE‑653 to bypass the sandbox and execute arbitrary code with the privileges of the application process.