GitLab's Threat Research Group discovered a critical sandbox escape vulnerability in the Node.js library vm2, rated CVSS 3.1: 10.0. This flaw allows remote code execution and stems from default configurations in vm2's own README. The vulnerability is directly exploitable in vm2 versions 3.11.6 and earlier when require.external is enabled. GitLab confirmed they do not use vm2, and the vulnerability was privately reported and fixed quickly in version 3.11.7. However, the fix for this specific exploit does not fully address a broader configuration risk. Developers using require.external must manually harden configurations by restricting require.root and setting context to 'sandbox'. Due to vm2's history of recurring sandbox escape bugs, avoiding it for truly untrusted code and opting for containers or separate processes is recommended. The vulnerability works by allowing the sandboxed code to require vm2 itself, gaining access to the host's require() function. This enables the creation of a second, unrestricted sandbox with full execution capabilities. The fix in version 3.11.7 blocks the direct attack but leaves open vulnerabilities if require.root is too broad.