The vulnerability is a failure to sanitize the Error.cause property during exception handling in the vm2 sandbox. This oversight allows sandboxed code to capture a powerful host object such as process when the host exposes a function that throws an error whose cause is that object, and then execute arbitrary host commands. The flaw constitutes a privilege‑escalation from the sandbox to the host, effectively enabling remote code execution on the underlying system. The weakness is a classic example of improper configuration or omission of defensive coding (CWE‑693).

The affected product is patriksimek’s vm2, a JavaScript virtual machine crafted for Node.js. All releases prior to version 3.11.6 are vulnerable. Version 3.11.6 and later contain the fix. The library is used in many Node.js projects that require trusted isolation of untrusted code.

The advisory assigns a CVSS score of 9.9, indicating critical severity, and the EPSS score is not available. Since the vulnerability is listed as not in KEV, no widespread, authenticated exploitation is currently documented. Based on the description, the likely attack vector involves the host supplying an error‑throwing function with a host object as its cause, allowing the sandbox to recover that object and run commands. The requirement for a host‑side configuration means attackers must have some influence over the host code or the ability to supply such functions, but once present the exploitation is straightforward.