Isolated-vm Flaw Lets Sandboxed JavaScript Escape to Host for Potential RCE
A critical vulnerability (GHSA-864f-rcv7-6rh4) in the popular Node.js sandbox library isolated-vm allows guest JavaScript code to escape the isolated environment and corrupt memory in the host process The flaw resides in the ExternalCopy class's handling of the transferList option, specifically a type confusion bug in the C++ glue code that marshals values across V8 Isolate boundaries Impact ranges from reliable denial-of-service (controlled-address crash/SIGSEGV) to full guest-to-host sandbox e
Analysis
TL;DR
- A critical vulnerability (GHSA-864f-rcv7-6rh4) in the popular Node.js sandbox library isolated-vm allows guest JavaScript code to escape the isolated environment and corrupt memory in the host process
- The flaw resides in the ExternalCopy class's handling of the transferList option, specifically a type confusion bug in the C++ glue code that marshals values across V8 Isolate boundaries
- Impact ranges from reliable denial-of-service (controlled-address crash/SIGSEGV) to full guest-to-host sandbox escape with potential remote code execution (control-flow hijack)
- The vulnerability affects all versions up to and including 7.0.0, with patches released in versions 6.2.0 and 7.0.1
- The isolation primitive itself (V8's Isolate boundary) remains sound; the failure was in the binding layer wrapping it, not the core isolation mechanism
Why It Matters
This vulnerability is significant for AI practitioners and developers who rely on isolated-vm to execute untrusted JavaScript code in sandboxed environments, as it completely undermines the trust boundary that the library is designed to enforce. The fact that a type confusion in marshaling code can escalate from a simple crash to full remote code execution highlights the critical importance of rigorous security auditing in C++ binding layers that sit atop otherwise secure primitives. With nearly 1 million npm downloads in a single week and widespread use in production environments, this flaw poses an immediate risk to any application depending on isolated-vm for code isolation.
Technical Details
- Vulnerability Location: The bug exists in isolated-vm's
ExternalCopyclass, which is responsible for securely serializing JavaScript objects from the host isolate and deserializing them into guest isolates across V8 Isolate boundaries - Root Cause: A type confusion in the handling of the
transferListoption within the C++ glue code that marshals values across the V8 Isolate boundary, allowing a guest to corrupt host memory - Exploit Chain: Starting from a single
ivm.Reference(the standard capability-granting mechanism), researchers escalated from a controlled-address crash to full control-flow hijack of the host process, demonstrating complete guest-to-host sandbox escape - Affected Versions: All versions before and including 7.0.0; patched in versions 6.2.0 and 7.0.1 released earlier this month
- Discovery & Reporting: Identified by Endor Labs researcher Cristian-Alexandru Staicu, who reported the flaw through responsible disclosure; full exploit details have been withheld to prevent malicious exploitation
- Architecture Context: isolated-vm runs untrusted JavaScript inside independent V8 Isolate instances with separate heaps, preventing direct object sharing between host and guest environments
Industry Insight
- Supply Chain Security: Developers using isolated-vm should immediately audit their dependency trees and update to patched versions (6.2.0+ or 7.0.1+), as the library's popularity (2,900+ GitHub stars, ~1M weekly npm downloads) makes it a high-value target for attackers seeking host compromise
- Binding Layer Vigilance: This incident reinforces the principle that secure primitives (like V8 Isolate boundaries) can be undermined by insecure binding layers; organizations should prioritize security reviews of C++/native code wrappers around language-level isolation features, especially in open-source libraries handling untrusted input
- Defense-in-Depth for Sandboxing: Relying solely on language-level sandboxing is insufficient; applications should implement additional containment strategies such as running sandboxed code in separate processes, containers, or with mandatory access controls to mitigate the impact of potential escape vulnerabilities
Disclaimer: The above content is generated by AI and is for reference only.