Critical isolated-vm Flaw Lets Sandboxed JavaScript Escape to Host for RCE

Cybersecurity researchers at Endor Labs have disclosed a critical security flaw in isolated-vm, a popular open-source Node.js library used to run untrusted JavaScript inside V8 Isolates. The vulnerability, tracked as GHSA-864f-rcv7-6rh4, affects all versions up to and including 7.0.0 and has been patched in versions 6.2.0 and 7.0.1. With more than 2,900 stars on GitHub and nearly 1 million npm downloads over the past week, isolated-vm is a widely deployed sandboxing primitive that security teams rely on to isolate untrusted code from host applications.

The flaw, discovered by Endor Labs researcher Cristian-Alexandru Staicu, is a type confusion bug in the library's ExternalCopy class, the component responsible for safely serializing JavaScript objects between host and guest isolates via the transferList option. "A type confusion in ExternalCopy's handling of the transferList option lets code running inside the sandbox corrupt memory in the host process," Staicu explained. Starting from a single ivm.Reference — the standard mechanism hosts use to grant sandboxed code any capability at all — the researcher escalated the bug from a controlled-address crash into full control-flow hijacking of the host process, demonstrating a complete guest-to-host sandbox escape.

Successful exploitation enables memory corruption that can crash the host application with a segmentation fault (SIGSEGV) and, at maximum impact, achieve remote code execution on the host. Project maintainer Marcel Laverdet confirmed that the maximum demonstrated impact is "control-flow hijack of the host process, i.e., potential remote code execution in the host," while noting that any guest given an ivm.Reference can reliably trigger a denial-of-service crash. Full exploit details are being withheld to prevent in-the-wild abuse, and no CVE has been assigned at the time of disclosure.

Developers and security teams using isolated-vm should upgrade immediately to version 7.0.1 or 6.2.0. Staicu emphasized that "the most important takeaway is that what was not broken was the isolation primitive itself," referring to V8's underlying sandbox model. Organizations should also audit their perimeter through broader port scanning and SSL/TLS configuration checks to ensure that hosts running sandboxed workloads are not inadvertently exposing attack surfaces to untrusted networks.