A Critical Isolated-vm Vulnerability Has Been Discovered, Allowing Attackers to Take Control of Host Systems
In a worrying development that highlights the ongoing cat-and-mouse game between security researchers and threat actors, a critical vulnerability has been discovered in isolated-vm, a popular Node.js library used by developers worldwide. The bug, which affects ExternalCopy, a function responsible for transferring data across isolated JavaScript environments, can be exploited to achieve remote code execution (RCE) on the host system.
Isolated-vm allows developers to run untrusted JavaScript code within a completely isolated V8 instance, making it possible to execute multiple sandboxed code instances on the same machine. However, the recently identified type confusion bug can be abused by an attacker to bypass security checks and access sensitive data, ultimately leading to RCE on the host.
The issue arises when ExternalCopy reconstructs data in another Isolate, trusting a byte array list that has been iterated over twice. During the second pass, an attacker-controlled pointer can be dereferenced, resulting in a crash or control-flow hijack of the host process. According to EndorLabs, which discovered the vulnerability, any embedder that runs untrusted code in an isolate and shares even one Reference into it is affected.
Successful exploitation of this security defect not only puts the entire system at risk but also enables attackers to gain unauthorized access to sensitive information. The good news, however, is that patches for isolated-vm versions 6.2.0 and 7.0.1 have been released to prevent user JavaScript from running during the copy.
The vulnerability highlights the importance of keeping software up-to-date, especially in critical systems where security is paramount. As more developers adopt isolated-vm, it’s essential that they take immediate action to address this issue before it becomes a target for threat actors. By updating their isolated-vm versions and following best practices for secure coding, developers can significantly reduce the risk of RCE attacks.
In conclusion, the critical isolated-vm vulnerability serves as a stark reminder of the ongoing battle between security researchers and attackers. As we continue to rely on complex software systems, it’s crucial that we prioritize security and stay vigilant in identifying potential vulnerabilities before they’re exploited by malicious actors.
Source: SecurityWeek — 2026-08-21