DEV Community

Anoymask
Anoymask

Posted on

JavaScript Sandbox Escape via Type Confusion in isolated-vm

#security #threatintel

1. Basic Information

  • Article Title: GHSA-864f-rcv7-6rh4: Critical Type Confusion Vulnerability in isolated-vm
  • Publisher: Endor Labs
  • Publication Date: 2026-08-20
  • Update Date: None
  • Severity: High
  • Original Source: Endor Labs
  • Related Sources: GHSA-864f-rcv7-6rh4, Critical isolated-vm vulnerability leads to RCE on host
  • Related Entities:
  • malware: None
  • groups: None
  • cves: None
  • products: isolated-vm, Node.js, V8, n8n, Activepieces, Mastra AI
  • advisories: GHSA-864f-rcv7-6rh4

2. One-Sentence Summary

An isolated JavaScript environment abuses a double-read value difference to corrupt host Node.js process memory and hijack the control flow.

3. Attack Flow

1. Escape from Guest to Host

  1. The host runs untrusted JavaScript inside isolated-vm and passes at least one ivm.Reference.
  2. The guest reaches the ExternalCopy constructor.
  3. The transferList getter returns a normal ArrayBuffer on the first read, and a different attacker-controlled value on the second read.
  4. The C++ binding trusts the first type check, does not check the type a second time, and treats it as an ArrayBuffer.
  5. The type confusion leads to reading and writing control addresses and taking over the host control flow.

4. Attacker Position and Execution Location

  • Untrusted JavaScript running inside isolated-vm.
  • A guest that can receive one ivm.Reference from the host.
  • The execution result affects the host Node.js process, not the sandbox.

5. Visibility for Victims and Administrators

Victims

  • No end-user action is required. Inputs to AI workflows or code execution features can serve as the entry point.

Administrators / SOC

  • In a minimal PoC, the Node.js host crashes abnormally with SIGSEGV / exit 139.
  • In advanced exploitation, control moves from normal guest processing to host process control, so it does not end with just a crash.

6. Success and Failure Conditions

Success Conditions

  • Using isolated-vm version 7.0.0 or lower, or version 6 below 6.2.0.
  • Untrusted code runs inside the sandbox.
  • The guest can reach ivm.Reference or an attacker-controlled transferList.
  • Bypassing host process protections and proceeding to control flow hijacking.

Failure Conditions

  • Updating to version 7.0.1 or 6.2.0.
  • Not passing references to untrusted code, or disabling the feature.
  • Running code execution workers with low privileges, as disposable instances, and with network isolation.
  • Monitoring crashes and abnormal memory access.

7. What Happens on Success

  • Crash of the host Node.js process.
  • Destruction of the guest/host boundary.
  • Potential arbitrary code execution with host privileges.
  • Spillover to credentials and connection destinations of AI and automation infrastructure.

8. Observable Logs

Email

  • None

Proxy / SWG / DNS

  • Outbound traffic after exploitation depends on the payload; no public information available.

Endpoint / EDR

  • Node.js SIGSEGV / exit 139.
  • Crashes near v8::ArrayBuffer::IsDetachable.
  • Abnormal memory access, Node.js child processes, subsequent commands.

Identity / IdP

  • Use of credentials held by the host is a post-exploitation possibility; none observed in practice.

SaaS / Cloud

  • Auditing code execution nodes and workers in tools like n8n.
  • JavaScript generated or received by AI agents, along with execution history.

Network

  • Starts as normal internal guest processing, showing no network indicators.
  • Traffic after escaping the host requires separate baseline comparison.

9. Attack Success Determination

  • Attack Attempt Observed (Success Unconfirmed): No real-world exploitation observed in public information. Only transferList / getter inputs in the shape of a PoC are confirmed within the organization.
  • Initial Execution Confirmed: An untrusted guest executes the ExternalCopy path, causing a control address crash on the host.
  • Subsequent Compromise Confirmed: Confirmation of Node.js host control flow hijacking, child processes, credential access, etc.

10. Investigation Playbook

Trigger

  • Detecting vulnerable isolated-vm versions in dependencies.
  • Reproducible SIGSEGV in Node.js workers.
  • Host anomalies after running untrusted code.

Initial Confirmation

  • Identify the exact version of isolated-vm and where it is used.
  • Check the references and transferList paths passed to the guest.

Endpoint

  • Preserve core dumps, crash stacks, and executed JavaScript.
  • Investigate host child processes, files, and credential access.

Authentication / Cloud

  • Check worker environment variables, cloud credentials, and connection destinations.
  • Rotate tokens if compromise is suspected.

Subsequent Actions

  • Cross-check workers and tenants that processed the same code.
  • Track network and API operations after the escape.

Containment

  • Stop code execution features or isolate workers.
  • Update to 7.0.1 / 6.2.0.
  • Rebuild compromised hosts and change credentials.

Judgment Categories

  • Vulnerable dependency only
  • Exploitation input
  • Host crash
  • Control flow hijacking
  • Subsequent compromise

11. Defense and Detection Ideas

Single Event

  • Node.js SIGSEGV and isolated-vm stack.
  • ExternalCopy + stateful transferList getter inside guest code.

Timeline Correlation

  • Receive untrusted code -> Run isolated-vm -> Host crash / restart -> Suspicious child process.

Hunting Perspective

  • Dependencies with isolated-vm <= 7.0.0.
  • Implementation passing references to the guest.
  • Job input immediately before a crash.

Log Gaps

  • Complete code executed by AI / automation infrastructure.
  • Correlation IDs for guest and host.
  • Worker core dumps and dependency versions.

Priority Countermeasures

  • Update to 7.0.1 or 6.2.0.
  • Low-privilege, disposable workers.
  • Minimize references and isolate credentials.

12. Facts / Inference / Hypothesis

Facts

  • GHSA-864f-rcv7-6rh4 affects isolated-vm 7.0.0 and below, and was fixed in 7.0.1 and 6.2.0.
  • Type confusion occurs because a getter can return a different value while reading transferList twice.
  • Researchers demonstrated everything from control address crashes to host control flow hijacking.
  • The C++ binding layer that passes values was broken, not the V8 Isolate itself.

Inference

  • Environments running model-generated code in AI agents may be affected, similarly to standard multi-tenant JavaScript infrastructure.

Hypothesis

  • If the host holds high-privilege cloud credentials, the sandbox escape could escalate into a broader cloud compromise.

13. MITRE ATT&CK Mapping

  • T1190 Exploit Public-Facing Application (Confidence: Low) — When reaching from external code execution features. Not limited to the library alone.
  • T1068 Exploitation for Privilege Escalation (Confidence: Medium) — Breaking the boundary from guest privileges to host process privileges.
  • T1055 Process Injection (Confidence: Low) — A generalization of control flow hijacking; the article does not specify a particular injection technique.

14. Unknowns and Additional Investigation

  • Presence of real-world exploitation.
  • How each product passes references.
  • Complete RCE stability across OS and architectures.
  • CVE number (not assigned at the time of publication).

15. Impact on SOCs and General Operations

Organizations running automation infrastructure or AI code execution environments (such as n8n) should check worker privileges, credentials, and network isolation, rather than just updating npm packages. It is important not to dismiss crashes simply as availability issues.

16. Summary by Target Audience

For SOCs

Correlate Node.js crashes immediately following untrusted code execution with subsequent child processes.

For Administrators

Update isolated-vm to 7.0.1 or 6.2.0, and run code execution workers with lower privileges.

For Users

General users do not need to take action. Administrators of code execution features handle updates and isolation.

Top comments (0)