vm2 Node.js Library Vulnerabilities Enable Sandbox Escape and Arbitrary Code Execution
12 vm2 flaws (CVSS up to 10.0) enable sandbox escape in ≤3.11.1, causing remote code execution risk; patched in 3.11.2.
More info