Endor Labs disclosed a critical flaw in isolated-vm, the Node.js sandbox library, that affects all versions through 7.0.0 and is fixed in 6.2.0 and 7.0.1. The bug sits in ExternalCopy, the object-transfer code the library uses to move data between a V8 isolate and the host process.
In plain terms, a type confusion in the transfer list lets sandboxed JavaScript hand the host something it misreads, so the copy step turns into host memory corruption instead of safe marshalling. Endor Labs says that can crash the host and, in the worst demonstrated case, hijack control flow for potential remote code execution.
That matters anywhere isolated-vm is used as the trust boundary for untrusted JavaScript. If the host process also owns tenant data, plugins, or service privileges, a break in the marshalling layer can put the whole process at risk, not just the guest script.