thumbnail Exploit available for critical bug in VM2 JavaScript sandbox library