Affected Systems
isolated-vm library versions ≤7.0.0. Patched in versions 6.2.0 and 7.0.1. Affects Node.js environments using isolated-vm for sandboxing untrusted JavaScript. Package has ~1 million weekly npm downloads.
Exploitation Status
Proof-of-concept developed by Endor Labs researcher. Full exploit details withheld. No evidence of active exploitation in the wild reported. Vulnerability allows reliable controlled-address crash and demonstrated control-flow hijack.
Business Impact
Any application using isolated-vm to sandbox untrusted JavaScript is at risk. Attackers with access to sandboxed code can corrupt host memory, crash the host process (denial-of-service), or achieve remote code execution on the host system. The vulnerability undermines the core security boundary of isolated-vm. Type confusion in ExternalCopy's transferList handling allows guest code to break isolation given only an ivm.Reference object (standard capability grant mechanism).
Urgency
🔴 Immediate
Recommended Actions
- Update isolated-vm to version 6.2.0 (for 6.x users) or 7.0.1 (for 7.x users) immediately
- Audit all Node.js applications and developer environments for isolated-vm dependencies using npm list isolated-vm or package-lock.json review
- Review logs for unexpected crashes (SIGSEGV) in Node.js processes running isolated-vm that may indicate exploitation attempts
- If immediate patching is not possible, restrict or disable execution of untrusted JavaScript in isolated-vm sandboxes until update is applied
- Monitor GitHub advisory GHSA-864f-rcv7-6rh4 for CVE assignment and additional indicators of compromise as exploit details emerge