Isolated-vm Flaw Lets Sandboxed Java Script Escape to Host for Potential RCE

Summary: Researchers at Endor Labs disclosed a type confusion flaw in isolated-vm, a Node.js library for running untrusted JavaScript in V8 Isolates, affecting all versions up to and including 7.0.0 and patched in 6.2.0 and 7.0.1. The bug in the ExternalCopy class's handling of the transferList option lets sandboxed code corrupt host memory, escalating from a controlled-address crash to control-flow hijack of the host process.
What's compelling: The maintainer states the maximum demonstrated impact is control-flow hijack of the host process, meaning potential remote code execution, and the npm package saw nearly 1 million downloads in the past week. As researcher Cristian-Alexandru Staicu put it, V8's Isolate boundary held; what failed was the C++ glue code marshaling values across it.

Read the original at The Hacker News ↗

Topics: Supply Chain & AppSec
Related: Kitesurf is now open source Cyber Risks · Nov 13, 2026
Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026
ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026