The vulnerability stems from saferEval's inability to properly restrict access to the main execution context. The PoC demonstrates prototype pollution via Buffer.prototype.write and constructor.constructor chaining to access the 'process' object. Since saferEval is explicitly designed as the package's main evaluation entry point and the advisory states the package isn't suitable for user input processing, this function directly enables the sandbox escape when processing untrusted input.