Sandbox escape via interceptable Promise callback invocation

Code injection in vm2 before 3.10.2 allows attackers to escape the Node.js sandbox and run arbitrary code through Promise callbacks. In lib/setup-sandbox.js, globalPromise.then and globalPromise.catch invoke preserved Promise methods through interceptable .call(), allowing sandbox code to override Function.prototype.call and receive unsanitized callback values. Exploitation requires an application to execute attacker-controlled asynchronous JavaScript inside VM; successful escape runs code with the host Node.js process's privileges.