A vulnerability in vm2 prior to version 3.10.5 allows attackers to escape the sandbox via manipulation of the Promise species property. The fix for a previous advisory was insufficient because it relied on functions that can be overwritten, enabling attackers to execute arbitrary commands on the host system from within the sandbox.