A critical vulnerability (CVE-2026-47140) exists in versions of the vm2 Node.js sandboxing library prior to 3.11.4. The library, designed to isolate untrusted code, fails to block access to the 'process' and 'inspector/promises' built-in modules. This allows sandboxed code to bypass security restrictions and execute arbitrary code in the host process context. Attackers could exploit this flaw to compromise systems running vulnerable implementations of vm2. The CVSS score of 10.0 reflects the severity of this unrestricted code execution risk. All users of vm2 versions earlier than 3.11.4 are affected. Immediate mitigation requires upgrading to version 3.11.4 or later, which contains the necessary security patches. Developers using vm2 for code isolation should prioritize this update to prevent potential exploitation of this critical vulnerability.