Improper Control of Dynamically-Managed Code Resources
The NPM package `vm2` has a vulnerability in versions prior to 3.9.16 that can allow malicious actors to bypass `handleException()` to escape the sandbox which can then lead to Remote Code Execution (RCE) on the host running the sandbox. The flaw is in the way that the `transformer` function preprocesses code which allows an attacker to later bypass a `handleException()` which in its turn allows to raise a host exception. This can then be used to access the host "Function" constructor which allows to escape the sandbox and gain arbitrary code execution on the host.
CWE-913 - Improper Control of Dynamically-Managed Code Resources
The software does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.