Critical isolated-vm Flaw Enables Remote Code Execution on Host

A critical-severity type confusion vulnerability in the isolated-vm Node.js library could allow threat actors to achieve remote code execution (RCE) on the underlying host system, according to security researchers at EndorLabs. The library enables developers to leverage V8's Isolate interface to build fully isolated JavaScript execution environments, each with its own heap memory, execution state, and garbage collector, allowing multiple sandboxed JavaScript instances to run on the same machine without containers or virtual machines.

The flaw resides in ExternalCopy, the function responsible for copying data across Isolates by serializing data in one instance and reconstructing it in another. For performance optimization, the function supports a transferList mechanism that detaches large ArrayBuffers from the source and transfers ownership to the destination. The bug occurs because the reconstructor iterates over the byte array list twice and trusts the results of the first pass during the second, creating a time-of-check/time-of-use (TOCTOU) weakness. An attacker can exploit this by defining a JavaScript getter on the transfer_list array that returns different values on each iteration, ultimately dereferencing an attacker-controlled pointer. While ExternalCopy is host-accessible, a guest sandbox can target ivm.Reference—the mechanism hosts use to expose objects—to construct the malicious transferList and trigger the flaw. Operators can use a port scanner to identify exposed Node.js services running vulnerable isolated-vm versions.

Successful exploitation results in either a denial-of-service crash or full control-flow hijacking of the host process, potentially enabling arbitrary code execution. "Any embedder that runs untrusted code in an isolate and shares even one Reference into it is affected. Host code that passes a caller-influenced array as transferList is affected directly, without any guest," the isolated-vm advisory warns. The vulnerability lives in the native C++ glue code that manipulates raw V8 handles and backing-store pointers in memory-unsafe operations. Patches were shipped in isolated-vm versions 6.2.0 and 7.0.1, which prevent user JavaScript from executing during the copy operation. Organizations should also audit their services with an SSL/TLS checker to ensure hardened transport security alongside the patched library, since compromised hosts may expose additional attack surfaces.