Remote Code Execution (RCE)

vm2 is vulnerable to remote code execution. The vulnerability exists in the Object.defineProperties function of setup-sandbox.js, allowing an attacker to bypass the sandbox protections by injecting and executing malicious code on the sandbox host...

Prototype Pollution

vm2 is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes via Object.defineProperties...