A severe vulnerability discovered in isolated-vm, a widely used open-source sandboxing library for Node.js, can let malicious JavaScript inside a sandbox escape its confines and possibly achieve remote code execution (RCE).
What is isolated-vm and how the flaw works
Isolated-vm is a library that enables running untrusted JavaScript in isolated V8 engine instances called “isolates,” designed to enforce strong segregation between sandboxed environments. It uses mechanisms like ExternalCopy to move data safely between the host and isolated contexts. The vulnerability lies in how the transferList option of ExternalCopy is handled, causing a type confusion bug that allows sandboxed code to corrupt memory in the host process. This violates the trust boundary between guest code and host. The bug has been shown to escalate from triggering controlled memory crashes (denial-of-service) to hijacking the host’s control flow, enabling execution of arbitrary code. ([thehackernews.com](https://thehackernews.com/2026/08/isolated-vm-flaw-lets-sandboxed.html))
Which versions are affected and what’s been fixed
The flaw, tracked under advisory GHSA-864f-rcv7-6rh4, impacts all versions of isolated-vm at or below 7.0.0. It has not yet been assigned an official CVE number. Developers are strongly encouraged to update to patched versions 6.2.0 or 7.0.1, both released this month. ([thehackernews.com](https://thehackernews.com/2026/08/isolated-vm-flaw-lets-sandboxed.html))
Potential impact and technical details
Even an unprivileged guest code that holds an ivm.Reference—the standard method of granting capabilities to sandboxes—can exploit the flaw. At minimum, attackers could induce a segmentation fault in the host (a reliable crash). At worst, host control flow can be hijacked, enabling full remote code execution. Though the isolate boundary itself remains secure, the binding layer—specifically the glue code that marshals values across the boundary—contains the vulnerability. ([thehackernews.com](https://thehackernews.com/2026/08/isolated-vm-flaw-lets-sandboxed.html))
The developer community is warned that any use of isolated-vm before 6.2.0 or in version 7.0.0 is affected. The fix in versions 6.2.0 and 7.0.1 removes the unsafe handling within ExternalCopy.transferList that permitted type confusion. ([thehackernews.com](https://thehackernews.com/2026/08/isolated-vm-flaw-lets-sandboxed.html))
Why this matters now
Isolated-vm enjoys widespread use, with nearly one million weekly downloads. As a critical part of sandboxing strategy in environments that run untrusted or third-party JavaScript, its integrity underpins many security models. A flaw here doesn’t just risk crashes—it can completely upend trust in isolation mechanisms that are supposed to prevent escape from guest code to host. ([thehackernews.com](https://thehackernews.com/2026/08/isolated-vm-flaw-lets-sandboxed.html))
Security engineers, package maintainers, and developers should verify dependencies to ensure they do not depend on the vulnerable versions. Systems that make use of ivm.Reference granting should be prioritized for patching, especially in multi-tenant environments.
While the isolate architecture of V8 remains intact, this incident underscores a recurring lesson: binding layers are often the weak link in sandbox designs. Ensuring safety in glue code is just as vital as protecting core isolation primitives themselves.
This flaw in isolated-vm is alarming because it breaks one of sandboxing’s most essential guarantees—separation of execution contexts. Even if attackers only trigger a crash, that’s still a denial-of-service vulnerability. If they leverage control-flow hijack, the stakes skyrocket toward arbitrary code execution. Whatever the specific outcome, every organization using isolated-vm should treat this as urgent remediation: audit which versions are in use, update dependencies, and re-evaluate trust in related libraries where glue code spans security boundaries. The broader lesson is clear—secure isolation isn’t enough if the interface between safe and unsafe isn’t bulletproof.
