VM2 versions prior to 3.11.2 contain a sandbox escape vulnerability that allows attackers to execute arbitrary code on the host system by breaking the VM2 sandbox isolation. The flaw arises from improper handling of exceptions with null prototype objects, enabling attackers to access host functions and execute commands. This vulnerability is rated critical with a CVSS score of 9.8 and has been fixed in version 3.11.2.