vm2 is an open‑source sandbox for Node.js; before version 3.11.4 it contains a vulnerability that allows sandbox escape and arbitrary command execution on the host system. The flaw is a privilege escalation within the VM context, classified as CWE‑913, and can lead to full compromise of the host once an attacker can inject code into the sandbox.

The affected product is vm2, built by patriksimek. Versions prior to 3.11.4 are vulnerable; the fix is delivered in release 3.11.4 and later.

The vulnerability scores a perfect CVSS of 10, indicating the highest level of severity, yet its EPSS score is below 1% and it is not yet listed in the CISA KEV catalog, suggesting a low exploitation probability at present. Because the flaw requires the attacker to execute code inside the vm2 sandbox, the likely attack vector is local or within a compromised application that creates VM instances. If exploited, the attacker would gain unrestricted access to the host, enabling further attacks.