Security researchers disclose multiple critical vulnerabilities affecting the Node.js sandboxing library vm2. Several reports state that attackers can exploit these flaws to escape the vm2 sandbox and execute arbitrary code on the underlying host system, potentially compromising applications that run untrusted JavaScript using vm2. The library is described as an open-source component used to isolate untrusted code by intercepting and proxying JavaScript objects, with the intent that sandboxed code cannot access resources on the host. The disclosures characterize the issues as critical and indicate they are relevant to environments where vm2 is used to run third-party or otherwise untrusted JavaScript. Across the sources, the core concern is that sandbox boundaries can be bypassed through crafted inputs or execution paths, enabling code execution beyond the intended isolation. While specific technical details and scope are not fully reproduced in the provided excerpts, both sources agree on the overall risk: vm2’s sandboxing protections can fail under attack, leading to host-level code execution on vulnerable setups.