A critical flaw in the isolated-vm library can let untrusted JavaScript escape its sandbox and potentially run code on the host system. The bug is an unassigned type confusion issue in ExternalCopy affecting data transfer between V8 Isolates in isolated-vm, where a time-of-check/time-of-use weakness involving transferList and attacker-controlled getters can lead to a V8 sandbox escape, denial of service, or host process control-flow hijacking. Fixes were released in versions 6.2.0 and 7.0.1.
Why it matters: Any service using isolated-vm to run untrusted code could be at risk of full host compromise, so this is urgent for developers and platform operators. Update isolated-vm to 6.2.0 or 7.0.1 immediately and review any code paths that pass caller-influenced transferList data or expose ivm.Reference into sandboxes.
Ionut Arghire
2026.08.21
100% relevant
This article appears to be the initial reporting of a distinct critical isolated-vm vulnerability and patch release, and it does not match an existing tracked story in the list.
← Back to all stories