Vulnerabilities · 53 days ago
Endor Labs disclosed a critical flaw in isolated-vm, the Node.js sandbox library, that affects all versions through 7.0.0 and is fixed in 6.2.0 and 7.0.1. The bug sits in ExternalCopy, the object-transfer code the library uses to move data between a V8 isolate and the host process.
In plain terms, a type confusion in the transfer list lets sandboxed JavaScript hand the host something it misreads, so the copy step turns into host memory corruption instead of safe marshalling. Endor Labs says that can crash the host and, in the worst demonstrated case, hijack control flow for potential remote code execution.
That matters anywhere isolated-vm is used as the trust boundary for untrusted JavaScript. If the host process also owns tenant data, plugins, or service privileges, a break in the marshalling layer can put the whole process at risk, not just the guest script.
2 sources covering this story
Critical Isolated-vm Vulnerability Leads to RCE on Host
The type confusion bug can lead to V8 sandbox escape and control-flow hijacking of the host process.
Isolated-vm Flaw Lets Sandboxed JavaScript Escape to Host for Potential RCE
Isolated-vm's ExternalCopy type confusion lets sandboxed code corrupt host memory and potentially reach host RCE; fixes are in 6.2.0 and 7.0.1.
Part of the PlainSec briefing for 2026-08-24