Skip to content

Back to the catalog

We discovered a critical vulnerability in isolated-vm a sandbox that is widely used in popular AI-related projects | Blog | Endor Labs
endorlabs.comadvisory

We discovered a critical vulnerability in isolated-vm a sandbox that is widely used in popular AI-related projects | Blog | Endor Labs

Endor Labs researchers found a critical type confusion vulnerability (GHSA-864f-rcv7-6rh4) in isolated-vm, the Node.js library used to run untrusted JavaScript inside a separate V8 Isolate. A TOCTOU bug in ExternalCopy's transferList handling — where a malicious getter returns a valid ArrayBuffer on a validating pass but an attacker-controlled value on the unchecked second pass — lets guest code escalate from a controlled-address crash to full host control-flow hijack, given only a single ivm.Reference. The bug is fixed in isolated-vm 7.0.1/6.2.0; affected downstream users include n8n, Activepieces, Mastra, Budibase, Sim.ai, Directus, and Rocket.Chat, which rely on isolated-vm to sandbox user- and model-generated code.

TL;DR A TOCTOU type confusion in isolated-vm's ExternalCopy transferList lets a single shared Reference escalate to full guest-to-host sandbox escape and host control-flow hijack; fixed in 7.0.1/6.2.0.
Open original ↗

Organisations named here

  • Bilingual Problems
  • GHSA-864f-rcv7-6rh4
  • Marcel Laverdet
  • SandDriller

Technologies named here

  • isolated-vm
  • n8n
  • vm2
  • Activepieces
  • V8 Isolate / ValueSerializer
  • mastra
  • Endor Labs software composition analysis
  • Budibase
  • Sim.ai
  • Directus
  • Rocket.Chat
  • Screeps
  • Fly.io
  • Algolia
  • TripAdvisor
  • V8
  • Node.js

Techniques named here

  • Guest-to-host sandbox escape via capability endowment
  • Controlled-address crash / denial of service
  • Control-flow hijack via forged vtable

Related in AppSec