Host command execution via async generator exception capture

Sandbox escape in Patrik Simek vm2 before 3.11.3 allows attackers to execute arbitrary host commands through untrusted sandbox code. During async-generator yield* return handling, V8 awaits an attacker-controlled thenable and delivers a synchronous host exception back as an iterator result instead of sanitizing it at the sandbox boundary. Exploitation requires the target application to execute attacker-controlled JavaScript inside a vm2 sandbox; the leaked host-realm error constructor exposes process and child_process command execution.