Twelve critical security vulnerabilities discovered in the vm2 Node.js library that enable sandbox escape and arbitrary code execution. The vulnerabilities exploit various JavaScript mechanisms including __lookupGetter__, promise species properties, inspect functions, SuppressedError, Symbol-to-string coercion, host Object access, NodeVM allowlist bypass, prototype pollution, BaseHandler.getPrototypeOf, neutralizeArraySpeciesBatch(), and null proto exceptions. These flaws allow attackers to break out of the secure sandbox environment designed to run untrusted JavaScript code and execute arbitrary commands on the underlying host system.