VM2 versions prior to 3.11.2 contain a critical sandbox escape vulnerability via the neutralizeArraySpeciesBatch method. This flaw allows attackers to invoke host-side getters on array prototypes, exposing host objects including the host Function object, enabling arbitrary code execution on the host system. The vulnerability is fixed in version 3.11.2.