A flaw in vm2’s BaseHandler set trap neglects the receiver parameter, causing every property write to target the host object regardless of the actual receiver. This permits an attacker to inject properties—such as dangerous cross‑realm Symbol keys—into host objects from within a sandboxed context, potentially breaking isolation and enabling arbitrary code execution on the host.

Any installation of vm2 by patriksimek prior to version 3.11.4 is vulnerable. Users deploying vm2 3.11.3 and earlier are exposed.

The CVSS score of 8.6 indicates high severity, but the EPSS score of less than 1% suggests exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. An attacker must be able to run code inside the vm2 sandbox to trigger the flaw, but once inside the context, the set trap can leak writes to the host, bypassing future guard checks. The attack vector is local to the application using vm2, making it a critical risk for any code that executes untrusted input within a vm2 sandbox.