Improper Control of Dynamically-Managed Code Resources

Summary

The NPM package `vm2` has a vulnerability in versions prior to 3.9.16 that can allow malicious actors to bypass `handleException()` to escape the sandbox which can then lead to Remote Code Execution (RCE) on the host running the sandbox. The flaw is in the way that the `transformer` function preprocesses code which allows an attacker to later bypass a `handleException()` which in its turn allows to raise a host exception. This can then be used to access the host "Function" constructor which allows to escape the sandbox and gain arbitrary code execution on the host.