{"id":4880,"date":"2026-08-20T18:26:56","date_gmt":"2026-08-20T18:26:56","guid":{"rendered":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/2026\/08\/20\/critical-flaw-in-isolated-vm-can-lead-to-sandbox-escape-rce-threat\/"},"modified":"2026-08-20T18:26:56","modified_gmt":"2026-08-20T18:26:56","slug":"critical-flaw-in-isolated-vm-can-lead-to-sandbox-escape-rce-threat","status":"publish","type":"post","link":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/2026\/08\/20\/critical-flaw-in-isolated-vm-can-lead-to-sandbox-escape-rce-threat\/","title":{"rendered":"Critical Flaw in isolated-vm Can Lead to Sandbox Escape, RCE Threat"},"content":{"rendered":"
\"\"<\/div>\n

\"\"<\/p>\n

Developers for years have been using vm2, an open-source Node.js library<\/a>, to run untrusted JavaScript inside a secure and isolated sandbox environment. It uses Node.js\u2019s built-in modules and JavaScript Proxies and lets developers whitelist particular built-in Node modules or limit what the script can access.<\/p>\n

During that time, vm2 has been the default for safely running untrusted JavaScript, which Cris Staicu, senior security researcher for Endor Labs, calls \u201cone of the hardest problems in the Node.js ecosystem.\u201d<\/p>\n

However, over the years, there have been some two dozen instances of code breaking out of the sandbox, including one Endor Labs documented earlier this year<\/a>. The problem is that vm2 is used to build a security boundary inside a single V8 execution environment using proxies and prototype scrubbing, and untrusted code shares some of the same elements, according to Staicu.<\/p>\n

Another method, isolated-vm, uses stronger techniques, a key one being that each sandbox given its own V8 Isolate, an independent and self-contained instance of the V8 JavaScript engine with separate built-ins and no shared object graph with the host.<\/p>\n

\u201cThis is the same primitive Chrome uses to separate tabs,\u201d Staicu wrote in a new report<\/a> this week. \u201cGuest code gets no require, no host globals, and no references to host objects unless the embedder explicitly hands them over. That is a real, OS- and VM-enforced boundary, and it is why isolated-vm is trusted to run genuinely adversarial code.\u201d<\/p>\n

Finding a Flaw<\/h3>\n

That said, Endor Labs researchers discovered a critical flaw in isolated-vm that allows code running inside the sandbox to corrupt memory in the host process application. Tracked by Endor Labs as GHSA-864f-rcv7-6rh4<\/a> and with a CVE assignment pending, Staicu wrote that they didn\u2019t break the V8 Isolate sandbox; instead, \u201cwe broke the code that carries data into it.\u201d<\/p>\n

\u201cA type confusion in ExternalCopy\u2019s handling of the transferList option lets code running inside the sandbox corrupt memory in the host process,\u201d he wrote. \u201cStarting from nothing but a single ivm.Reference, the standard way hosts hand a sandbox any capability at all, we escalated the bug from a controlled-address crash all the way to hijacking the host\u2019s control flow, demonstrating a full guest-to-host sandbox escape.\u201d<\/p>\n

Such an escape<\/a> can allow the attacker to crash the host application, which can lead to a denial of service triggered by a guest. More dangerously, it can mean the hacker hijacking the host\u2019s control flow, which Staicu wrote opens a path to remote code execution (RCE) outside of the sandbox and in the host. The maintainer fixed it with patches in versions 7.0.1 and 6.2.0.<\/p>\n

Beware the TOCTOU<\/h3>\n

In JavaScript environments using isolated-vm, ExternalCopy is used to safely serialize data out of one isolate heap and deserialize it into another. When it serializes an object with a transferList, the constructor iterates over the list twice, validating every element and registering it with the serializer in the first step, while transferring each element in the second step without revalidating.<\/p>\n

This leads to a time-of-check to time-of-use (TOCTOU) gap, which occurs when a program checks a system state \u2013 in this case, the validated transferList in the first step \u2013 and then uses it moments later, assuming the state remains the same. In this case, the transfer of each element in the second step doesn\u2019t revalidate each element.<\/p>\n

\u201cThe attacker registers a stateful getter that hands a genuine ArrayBuffer to the validating walk and something else to the unchecked walk,\u201d Staicu wrote. \u201ctransferList is accepted only by the ExternalCopy constructor, which appears to be accessible only on the host side. But the guest does not need the entire ivm module; it only needs a single ivm.Reference: the ordinary mechanism a host uses to expose anything to a sandbox. The externalCopy transfer option pulls the ExternalCopy constructor across the boundary as a live, callable class.\u201d<\/p>\n

From there, the guest \u2013 the hacker \u2013 builds a malicious transferList, which triggers the malicious code from inside the isolate.<\/p>\n

Vulnerability in the C++ Glue Code<\/h3>\n

He reiterated that isolated-vm is a stronger sandbox than vm2 and that the flaw is not related to the V8 Isolate it\u2019s based on. The vulnerability is in the C++ glue code that serializes values across the boundary but is written in a memory-unsafe language<\/a>.<\/p>\n

A worry is that isolated-vm is a popular tool \u2013 with more than a million downloads a week \u2013 particularly when running AI-related projects, where executing model- or user-generated code safely is a core requirement in the age of AI agents and automation platforms.<\/p>\n

That list includes n8n, a workflow-automation platform that has garnered 200,000 GitHub stars, the Mastra agentic AI framework (27,000 stars), platform maker Sim.ai (29,000 stars), and Activepieces, an open source AI-first workflow automation platform (23,000 stars).<\/p>\n

The project\u2019s documentation indicates that isolated-vm also is the sandbox on record for such production systems as its own Screeps, a massively multiplayer online (MMO) environment that runs player-supplied code, edge compute system Fly.io, Algolia\u2019s custom crawler, and TripAdvisor, for server-side rendering.<\/p>\n

Apply the Fix<\/h3>\n

Developers need to migrate to isolated-vm 7.0.1 or 6.2.0 on the 6.x line and closely scrutinize their sandboxes, both what\u2019s in them and how they work.<\/p>\n

\u201cThat gap between \u2018the primitive is sound\u2019 and \u2018the system is safe\u2019 is where modern sandbox escapes increasingly live, and it is exactly the gap our research has been mapping,\u201d Staicu wrote. \u201cAs AI agents and automation platforms make untrusted-code execution a mainstream requirement, the binding layer around your sandbox deserves first-class security attention.\u201d<\/p>\n

Read More<\/a><\/p>\n

\u200b<\/p>","protected":false},"excerpt":{"rendered":"

Developers for years have been using vm2, an open-source Node.js library, to run untrusted JavaScript inside a secure and isolated […]<\/p>\n","protected":false},"author":1,"featured_media":4881,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[5],"tags":[],"class_list":["post-4880","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-devops"],"_links":{"self":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts\/4880","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/comments?post=4880"}],"version-history":[{"count":0,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts\/4880\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/media\/4881"}],"wp:attachment":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/media?parent=4880"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/categories?post=4880"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/tags?post=4880"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}