vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, SuppressedError allows attackers to escape the sandbox and run arbitrary code. This issue has been patched in version 3.11.0.
Upstream public commits fixing this issue: https://github.com/patriksimek/vm2/commit/4cb82cc94d9bb6c9a918b45f8c6790c32a5e913f https://github.com/patriksimek/vm2/commit/d715dd88c5aec5bbb4dce03ddf7c3eb3791d0338 Those commits are contained in the following upstream releases: $ git tag --contains 4cb82cc94d9bb6c9a918b45f8c6790c32a5e913f v3.11.0 v3.11.1 v3.11.2 v3.11.3 $ git tag --contains d715dd88c5aec5bbb4dce03ddf7c3eb3791d0338 v3.11.0 v3.11.1 v3.11.2 v3.11.3