Critical isolated-vm Vulnerability Leads to RCE on Host

The Sandbox Is Broken

Security researchers at Endor Labs have disclosed a critical vulnerability in isolated-vm, the dominant Node.js library for running untrusted JavaScript inside V8 Isolates. Tracked as GHSA-864f-rcv7-6rh4, the flaw allows malicious code running inside the supposedly secure sandbox to escape and execute arbitrary commands on the host process.

The library sees nearly 1 million npm downloads per week and underpins code execution in AI agent frameworks, multi-tenant SaaS platforms, plugin systems, and serverless automation pipelines. The impact radius is enormous.

The Vulnerability: TOCTOU in ExternalCopy

The bug is a time-of-check to time-of-use (TOCTOU) race in the C++ layer that handles ExternalCopy — the mechanism used to safely transfer objects between the host and the sandboxed isolate.

How It Works

When ExternalCopy processes an object with a transferList, the implementation:

1. Validates each element in the transfer list (first pass)
2. Transfers the elements (second pass)

The critical flaw: between these two passes, nothing prevents JavaScript from executing. An attacker-controlled getter on an object in the transferList can mutate the list between validation and transfer, causing a type confusion that corrupts host process memory.

Attack chain:
1. Malicious code inside isolate creates object with attacker-controlled getter
2. ExternalCopy validates transferList elements (pass 1) — looks clean
3. Getter fires during transfer phase (pass 2) — mutates the list
4. Type confusion corrupts host memory at a controlled address
5. Exploit chain progresses to control-flow hijacking
6. Arbitrary code execution on the host process

Researcher Cristian-Alexandru Staicu from Endor Labs demonstrated a full working exploit chain: from controlled crash, through address leak, to complete sandbox escape with host RCE.

Who Is At Risk

Any application running version 7.0.0 or earlier is vulnerable. The attack requires only a standard ivm.Reference — the ordinary way a host exposes any capability to sandboxed code.

Why AI Stacks Are Especially Exposed

Many LLM-based agent frameworks use isolated-vm to sandbox tool calls or code generated by the model. A malicious prompt payload crafted to produce exploit code could escape the sandbox, turning an AI agent into an unintentional code execution backdoor on the server running it.

The Fix

The patch (released August 2026) wraps ExternalCopy::Copy in a v8::Isolate::DisallowJavascriptExecutionScope. This prevents any JavaScript — including getters, Proxy traps, and interceptors — from executing during the copy operation, closing the TOCTOU window entirely.

Update Instructions

# Check your current version
npm list isolated-vm
 
# Update to patched version
npm install isolated-vm@latest
 
# Or pin to a specific patched release
npm install isolated-vm@7.0.1
# or
npm install isolated-vm@6.2.0

Detection and Mitigation

Until patching is complete, consider the following compensating controls:

1. Restrict what the isolate can transfer — audit all transferList usage in your codebase and ensure objects with user-controlled properties are never transferred
2. Network-isolate your Node.js process — limit outbound connections so a successful exploit cannot establish a reverse shell
3. Run isolated-vm workloads in dedicated containers with strict resource limits and no access to sensitive credentials
4. Monitor for anomalous child process spawns from your Node.js service — a common first action after host compromise

Detection Query (Splunk)

index=app sourcetype=nodejs_logs process_name=node
| where match(_raw, "child_process|exec|spawn")
  AND NOT match(_raw, "expected_subprocess_pattern")
| stats count by host, pid
| where count > 5

Context: The Broader isolated-vm Security Picture

This is not the first sandbox escape in the Node.js ecosystem. The now-deprecated vm2 library suffered a string of similar exploits throughout 2023-2025. isolated-vm emerged as the safer alternative, but this disclosure demonstrates that C++ extension code bridging host and guest environments remains a high-risk attack surface — especially under adversarial conditions.

For teams building multi-tenant code execution, the architecture lesson is clear: the sandbox should be a defense-in-depth layer, not the sole trust boundary. Pair it with OS-level isolation (containers, gVisor, Firecracker microVMs) to contain the blast radius of any future escape.

Sources

• GHSA-864f-rcv7-6rh4 — isolated-vm Advisory
• Endor Labs — Critical Type Confusion in isolated-vm
• The Hacker News — Isolated-vm Flaw Lets Sandboxed JavaScript Escape to Host
• DevOps.com — Critical Flaw in isolated-vm Can Lead to Sandbox Escape
• Kodem Security — vm2 Sandbox Escape Vulnerabilities 2026

Related Reading

• VoidLink: AI-Generated Cloud-Native Malware Framework
• Apache Struts Critical RCE via OGNL Injection Returns