GHSA-ch3r-j5x3-6q2m

There exists a vulnerability in exception sanitization of vm2 for versions up to 3.9.16, allowing attackers to raise an unsanitized host exception inside `handleException()` which can be used to escape the sandbox and run arbitrary code in host context.

### Impact A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox.

### Patches This vulnerability was patched in the release of version `3.9.17` of `vm2`.

### Workarounds None.

### References PoC - https://gist.github.com/leesh3288/381b230b04936dd4d74aaf90cc8bb244

### For more information

If you have any questions or comments about this advisory:

- Open an issue in [VM2](https://github.com/patriksimek/vm2)

Thanks to [Xion](https://twitter.com/0x10n) (SeungHyun Lee) of [KAIST Hacking Lab](https://kaist-hacking.github.io/) for disclosing this vulnerability.