Vulnerabilities

Critical isolated-vm Flaw Lets Untrusted JavaScript Escape Sandbox

Critical Node.js vulnerability in isolated-vm allows JavaScript to escape sandbox, risking host process control. Upgrade to version 7.0.1 now.

By Content Team

Aug 24, 2026

ON THIS PAGE

A critical vulnerability in the Node.js sandboxing library isolated-vm can let untrusted JavaScript break out of its sandbox and hijack the host process. Tracked as GHSA-864f-rcv7-6rh4, the flaw affects versions before 7.0.1 and 6.2.0, with fixes released August 8, 2026.

Endor Labs researchers found the bug in native C++ binding code handling data transfers between V8 Isolates. An attacker can exploit a type-confusion and TOCTOU gap in ExternalCopy's transferList option using a JavaScript getter — swapping a valid ArrayBuffer for malicious data between validation and transfer.

At minimum, this crashes the host process. At worst, it enables arbitrary code execution outside the sandbox. Upgrade immediately.

Source: Cybersecurity News

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?