Host command execution via unsanitized Error.cause

Sandbox escape in vm2 before 3.11.6 allows attackers to execute host commands via errors whose cause property carries host objects. The handleException() routine in lib/setup-sandbox.js sanitizes SuppressedError and AggregateError fields but returns ordinary errors without recursively sanitizing Error.cause, so a caught host-thrown error can expose references such as process to sandbox code. Exploitation requires an embedder-exposed host function to throw an error whose cause chain includes a powerful host object; once that gate is present, attacker-supplied code running inside the sandbox can pivot to full code execution as the host process.