vm2 up to version 3.12.0 incorrectly exposes the Node.js crypto.setFips function to untrusted guest code when the embedder allows the crypto builtin. The sandbox sanitizer replaces crypto.setEngine but leaves crypto.setFips callable, and the readonly wrapper does not isolate side effects, so guest code can alter the host process’s FIPS mode. This cross‑boundary change of a global cryptographic setting constitutes a sandbox escape that can break isolation guarantees.

Affected systems include the vm2 library from the VM2 project, specifically all releases prior to 3.12.1 such as 3.11.8 and earlier up to 3.12.0. The vulnerability exists when a NodeVM is configured with require.builtin:['crypto'] and is not mitigated by any in‑package guard. Deployments that use vm2 for untrusted code execution are at risk.

The CVSS score of 6.9 rates this as medium severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers who can inject code into the guest environment could exploit the exposed crypto.setFips to change the host's cryptography configuration; the exploit requires local or sandbox‑based code execution within the VM, but the impact crosses the isolation boundary, making it a significant risk for applications that rely on vm2 for secure isolation.