Critical Type Confusion Flaw in isolated-vm Node.js Sandbox Let Guest Code Escape to the Host

Overview

Researchers have disclosed a critical vulnerability in isolated-vm, a widely used Node.js sandboxing library, that let JavaScript code running inside the sandbox corrupt memory in the host process and, in the worst case, hijack the host’s control flow, according to The Hacker News. The flaw was found and reported by Endor Labs researcher Cristian-Alexandru Staicu and is tracked as GHSA-864f-rcv7-6rh4; it has not yet been assigned a CVE identifier.

What We Know

• Isolated-vm is a Node.js library for running untrusted JavaScript inside a V8 Isolate — an independent instance of the Google V8 JavaScript engine — allowing multiple sandboxed JavaScript environments to run concurrently without sharing data or interfering with each other, according to The Hacker News.
• The project has more than 2,900 stars and 190 forks on GitHub, and the npm package has seen nearly 1 million downloads over the past week, according to The Hacker News.
• The vulnerability sits in ExternalCopy, the class isolated-vm exposes to serialize JavaScript objects out of the host isolate and deserialize them into the guest isolate, since each V8 Isolate keeps a separate state and heap and objects cannot be passed directly between the main Node.js thread and a worker isolate, according to The Hacker News.
• According to the GitHub Security Advisory, calling ivm.ExternalCopy(value, { transferList }) traverses the transfer list array twice: “Walk 1 validates each element” while “walk 2 does not validate; unchecked reinterpret-cast.” Because array accessors can return different values on each traversal, an attacker can pass validation with an ArrayBuffer on the first walk and inject a different value that gets unsafely cast on the second, corrupting memory.
• “A type confusion in ExternalCopy’s handling of the transferList option lets code running inside the sandbox corrupt memory in the host process,” Staicu said in a technical write-up shared with The Hacker News.
• “Starting from nothing but a single ivm.Reference, the standard way hosts hand a sandbox any capability at all, we escalated the bug from a controlled-address crash all the way to hijacking the host’s control flow, demonstrating a full guest-to-host sandbox escape,” Staicu said, according to The Hacker News.
• Project maintainer Marcel Laverdet described the range of impact in the advisory: “Minimum demonstrated impact is a reliable, controlled-address crash (denial-of-service) triggerable by any guest that has been given an ivm.Reference (the standard way to grant a sandbox any capability). Maximum demonstrated impact is control-flow hijack of the host process, i.e., potential remote code execution in the host,” as quoted by The Hacker News.
• The bug affects all versions of isolated-vm before and including 7.0.0, and has been patched in versions 6.2.0 and 7.0.1, released earlier this month, per the GitHub Security Advisory and The Hacker News.
• Users who have isolated-vm installed are advised to update to the latest version; additional exploit details have been withheld to prevent bad actors from replicating the attack, according to The Hacker News.
• “The most important takeaway is that what was not broken was the isolation primitive itself,” Staicu said. “V8’s Isolate boundary held. What failed was the C++ glue code that marshals values across that boundary. A perfectly sound building block was undermined by the binding layer wrapped around it,” according to The Hacker News.

What We Don’t Know

• No CVSS score has been published for the flaw, and no CVE identifier had been assigned as of the disclosure.
• The full technical exploit chain, including proof-of-concept code, has not been made public, so the exact conditions required to escalate from a crash to control-flow hijacking in a given deployment remain undisclosed.

Analysis

The disclosure is notable less for what it broke than for what it didn’t: the underlying V8 Isolate boundary that isolated-vm relies on for guest/host separation held up. The failure was in the C++ binding layer marshaling data across that boundary — a reminder that sandboxing tools built on sound primitives can still be undermined by the glue code wrapping them. Because isolated-vm is used to run untrusted or third-party JavaScript inside larger applications, a guest-to-host escape in its core serialization path is the kind of flaw that erodes the trust boundary the library exists to provide, independent of how any single downstream project uses it.