GHSA-864f-rcv7-6rh4: Critical Type Confusion Vulnerability in isolated-vm

A critical vulnerability in isolated-vm, tracked as GHSA-864f-rcv7-6rh4 with a pending CVE, allowed untrusted JavaScript running in a V8 Isolate to escape its sandbox by exploiting a type-confusion flaw in ExternalCopy’s transferList handling. The flaw arose because the library validated transferList entries during one iteration but reread them during a second iteration without validation, enabling a JavaScript getter to return a legitimate ArrayBuffer first and a different value later, which was unsafely cast and dereferenced in native C++ code. Researchers demonstrated that a sandbox supplied with only a single ivm.Reference could trigger a controlled host-process crash and, in a more advanced proof of concept, redirect host control flow. The issue affected isolated-vm versions before 7.0.1 and 6.2.0, and was fixed by preventing JavaScript execution during the sensitive copy operation. The report emphasizes that V8’s Isolate separation itself remained intact; the failure was in the native binding layer used to marshal data across the boundary, illustrating the security importance of minimizing exposed capabilities and auditing glue code around otherwise sound isolation primitives.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.