vm2 is a Node.js library that creates virtual machine sandboxes for untrusted code. A flaw in the handling of JSPI‑backed promises allows the sandbox to break its isolation. By exploiting the way Promise.prototype.finally() is called with a host‑originated rejection object that reaches attacker‑controlled species logic, malicious code can be executed outside the isolated environment. The weakness is classified as CWE‑913, giving an attacker full control of the host process.

The vulnerability applies to all versions of vm2 before 3.11.4. Users running any prior release on Node.js environments that expose WebAssembly JSPI (WebAssembly.promising / WebAssembly.Suspending) and that enable async support are impacted. Version 3.11.4 and later include the patch.

The CVSS score of 9.8 marks this vulnerability as Critical. The EPSS is reported as less than 1 %, indicating a low probability of exploitation in the wild, and it is not present in the CISA KEV catalog. Nonetheless, the attack can be performed by any code that runs within vm2 in an affected environment, simply by using async features and WebAssembly promises; no additional setup beyond the normal usage of the library is required.