---
title: Critical isolated-vm Flaw Lets Untrusted JavaScript Escape Sandbox
description: Critical Node.js vulnerability in isolated-vm allows JavaScript to escape sandbox, risking host process control. Upgrade to version 7.0.1 now.
canonical_url: https://codekeeper.co/ticker/node-js-sandbox-escape-vulnerability
---

[Vulnerabilities](https://codekeeper.co/ticker/tag/vulnerabilities)

# Critical isolated-vm Flaw Lets Untrusted JavaScript Escape Sandbox

Critical Node.js vulnerability in isolated-vm allows JavaScript to escape sandbox, risking host process control. Upgrade to version 7.0.1 now.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Aug 24, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnode-js-sandbox-escape-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnode-js-sandbox-escape-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnode-js-sandbox-escape-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnode-js-sandbox-escape-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnode-js-sandbox-escape-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnode-js-sandbox-escape-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

A critical vulnerability in the Node.js sandboxing library isolated-vm can let untrusted JavaScript break out of its sandbox and hijack the host process. Tracked as GHSA-864f-rcv7-6rh4, the flaw affects versions before 7.0.1 and 6.2.0, with fixes released August 8, 2026. Endor Labs researchers found the bug in native C++ binding code handling data transfers between V8 Isolates. An attacker can exploit a type-confusion and TOCTOU gap in ExternalCopy's transferList option using a JavaScript getter — swapping a valid ArrayBuffer for malicious data between validation and transfer. At minimum, this crashes the host process. At worst, it enables arbitrary code execution outside the sandbox. Upgrade immediately. **Source:** [Cybersecurity News](https://cybersecuritynews.com/critical-isolated-vm-flaw/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnode-js-sandbox-escape-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnode-js-sandbox-escape-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnode-js-sandbox-escape-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnode-js-sandbox-escape-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnode-js-sandbox-escape-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnode-js-sandbox-escape-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Hackers Use Ghost CMS Flaw to Infect 700+ Websites With ClickFix Malware Aug 12, 2026](https://codekeeper.co/ticker/ghost-cms-vulnerability-exploited-by-hackers)

[Lincoln Cathedral and Leisure Centres Hit by Cyber Attack on CRM Provider Aug 11, 2026](https://codekeeper.co/ticker/beacon-crm-data-breach-lincoln-cathedral)

[Cyberattacks Ransomware Attack Hits Norcross City Systems Sep 1, 2026](https://codekeeper.co/ticker/norcross-ga-ransomware-attack-recovery)

[Data breaches Hackers Dump 8.7 Million Airport Customers' Data on the Open Internet Sep 4, 2026](https://codekeeper.co/ticker/manchester-airports-data-breach-exposes-travel-info)