vm2 is an open‑source virtual machine and sandbox for Node.js. Versions prior to 3.11.2 are affected by a sandbox breakout vulnerability. An error caused by a null prototype reference allows code executing inside a vm2 sandbox to escape the isolation boundary and run arbitrary instructions with the privileges of the hosting Node.js process. The weakness is classified as CWE‑668, indicating a privilege escalation that bypasses intended access controls, leading to potential compromise of confidentiality, integrity, and availability of the host application.

Affected products include the patriksimek:vm2 library for Node.js, in all releases older than 3.11.2. Applications that embed this library and run untrusted code within vm2 are at risk. Any deployment that depends on an older version without applying the update is considered vulnerable.

The CVSS base score of 9.8 indicates critical severity, reflecting the full compromise of the host process. The EPSS score is not available, so the exploitation probability cannot be measured precisely, but the lack of listing in the CISA KEV catalog suggests no active exploits have been documented yet. The likely attack vector is local or within the Node.js environment; an attacker who can supply malicious input consumed by vm2 can trigger the null prototype exception and escape the sandbox, achieving remote code execution with the capabilities of the application process.