Researchers at Endor Labs have demonstrated a full escape from isolated-vm, a popular Node.js sandbox used to run untrusted JavaScript in AI and cloud workloads. The bug, tracked as GHSA-864f-rcv7-6rh4, affects every version up to 7.0.0 and is fixed in 6.2.0 and 7.0.1.
The weakness sits in ExternalCopy, the component that serializes objects between the host and guest V8 isolates. A type confusion in how it handles the transferList option lets code inside the sandbox corrupt memory in the host process. The researchers escalated the issue from a controlled crash to full control-flow hijacking, starting with nothing more than a single ivm.Reference, the standard handle hosts hand to a sandbox.
isolated-vm powers environments that execute untrusted third-party code, including AI agents and evaluation harnesses, and the package sees close to a million downloads a week. A sandbox escape in that context means the isolation boundary was the only thing standing between untrusted code and the host.
Teams using isolated-vm should upgrade to 6.2.0 or 7.0.1 immediately. Endor Labs notes the patched versions are drop-in replacements, and any deployment still below those releases should be treated as running untrusted code on the host.
