vm2 is vulnerable to Arbitrary Code Execution. The vulnerability exists because the newWrapped
function of setup-sandbox.js
does not properly handle host objects passed to Error.prepareStackTrace
in case of unhandled async errors, which allows an attacker to bypass the sandbox protections and execution arbitrary code on the system.