A critical vulnerability in isolated-vm, an open-source sandbox library with over 2,900 stars on GitHub, permits attackers to break free from isolated environments and execute code on host systems, according to cybersecurity researchers. The flaw, disclosed by Endor Labs and catalogued as GHSA-864f-rcv7-6rh4, affects every version of the library through 7.0.0. The Node.js package, which enables untrusted JavaScript to run inside independent V8 engine instances, recorded close to 1 million downloads in the past week alone.
The security weakness resides in ExternalCopy, a class that serializes JavaScript objects from the host isolate and deserializes them into guest isolates. A type confusion bug in ExternalCopy's handling of the transferList option enables code operating within the sandbox to corrupt memory in the host application. Patches addressing the vulnerability shipped in versions 6.2.0 and 7.0.1 earlier this month. The library had not yet received a CVE identifier at the time of disclosure.
Successful exploitation triggers memory corruption in the host process, researcher Cristian-Alexandru Staicu told The Hacker News, with minimum impact being "a reliable, controlled-address crash (denial-of-service) triggerable by any guest that has been given an ivm.Reference." Project maintainer Marcel Laverdet noted the maximum demonstrated consequence is control-flow hijacking of the host process, potentially enabling remote code execution. Staicu reported escalating the bug "from a controlled-address crash all the way to hijacking the host's control flow, demonstrating a full guest-to-host sandbox escape" starting from nothing but a single ivm.Reference, the standard method hosts use to grant sandboxes any capability.
The vulnerability undermines the trust boundary that forms the core purpose of isolated-vm, which was designed to prevent sandboxed JavaScript environments from sharing data or interfering with one another. Because each V8 Isolate maintains separate state and its own heap, direct passing of JavaScript objects from the main Node.js thread into worker isolates isn't possible under normal conditions—ExternalCopy was built to bridge that gap securely. The flaw reveals that while V8's isolation primitive itself remained intact, the C++ binding code marshalling values across the boundary failed. Full exploit details have been withheld to prevent malicious use by threat actors.
Users with isolated-vm installed in developer environments should update to patched versions immediately for optimal protection. The incident demonstrates how wrapper code around sound security primitives can introduce critical weaknesses even when underlying isolation mechanisms hold firm. Organizations relying on sandbox technologies face a persistent challenge: trusted execution boundaries depend not only on robust core primitives but equally on the correctness of integration layers that connect them to real-world applications. Security teams evaluating containerization and isolation solutions will need to scrutinize both the foundation and the frameworks built atop it.