From the release notes, seems like it might be something of a jail break or privilege escalation based on using an environment variable value instead of system calls from the supported library. Maybe something with the X11 windows host.

Curious to see what it actually turns out to be. I'm often impressed by some of the security vulnerabilities people manage to find and exploit. I'm not nearly as creative to even think of trying some of the things people export in a practical way.