Critical vm2 Node.js Library Vulnerabilities Enables Arbitrary Code Execution Attacks

The report discloses eleven critical vulnerabilities in the vm2 Node.js sandboxing library (affecting versions up to 3.11.1), several of which allow full sandbox escape and remote code execution on the host. It enumerates CVEs, affected and patched versions (two CVEs remain unpatched), describes multiple attack techniques (prototype manipulation, Promise species overwrites, WebAssembly exception handling, util.inspect and Module._load abuses), and recommends upgrading to 3.11.1 where available or replacing vm2 with kernel-level isolation (Docker, gVisor, Firecracker) and avoiding unsafe configurations such as nesting:true and wildcard built-ins.