But the fact that the VM has not seen much scrunity by the community together with the following snippet from the linked page:

"There are several known bugs in the RarVM.

[redacted as some have security consequences]"

makes it seem quite likely that there are some ugly vulnerabilities.