vm2's code transformer optimization bypasses AST analysis for code lacking the keywords catch, import, or async, allowing sandboxed code to access an internal state variable exposing security functions. This bypass disables internal checks that normally prevent access to VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL, exposing methods like handleException, wrapWith, and import. While these methods are currently defensive and not direct escape vectors, the bypass represents a complete security control failure and could enable future exploits if sensitive methods are added. The vulnerability affects all vm2 versions prior to 3.11.0 and requires no special configuration. A patch is available in version 3.11.0 that adds additional keyword checks to prevent this bypass.