JavaScript Sandbox Escape via Type Confusion in isolated-vm
1. Basic Information Article Name : GHSA-864f-rcv7-6rh4: Critical Type Confusion Vulnerability in isolated-vm Publisher : Endor Labs Publication Date : 2026-08-20 Update Date : None Severity : high Original Source : https://www.endorlabs.com/learn/ghsa-864f-rcv7-6rh4-critical-type-confusion-vulnerability-in-isolated-vm Related Sources : GHSA-864f-rcv7-6rh4 , Critical isolated-vm vulnerability…
The isolated-vm JavaScript sandbox contains a critical type confusion vulnerability, which allows untrusted code to escape the sandbox and take control of the host Node.js process. If exploited, this vulnerability could lead to arbitrary code execution with host privileges, potentially granting attackers access to sensitive data and credentials.
The vulnerability exists in versions of isolated-vm lower than 7.0.1 and 6.2.0. It is triggered when untrusted code reaches the ExternalCopy constructor and an attacker-controlled value is returned by a getter during a transferList read. This results in control address manipulation and hijacking of the host control flow. Affected platforms include Node.js, V8, n8n, Activepieces, and Mastra AI.
The vulnerability requires no user interaction, as it can be exploited through inputs to AI workflows or code execution features. Administrators and SOCs should monitor for abnormal crashes and memory access, as well as abnormal traffic patterns after exploitation. The high severity of this vulnerability warrants immediate updates to the affected versions or disabling of the vulnerable feature.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
