Loading story…
A high-severity denial-of-service vulnerability in the Node.js library Shescape allows a remote unauthenticated attacker to exhaust CPU resources and halt application processing by sending crafted input to the library's compose() function. The flaw, tracked as GHSA-gm3r-q2wp-hw87, is caused by quadratic-time behavior in the library's default flag-protection logic, where repeated array copying and string joining inside a loop can be abused with repeated null-byte and hyphen sequences to block the single-threaded Node.js event loop. The issue is classified under CWE-407 and CWE-400 and carries a CVSS v4.0 score of 8.7.
The bug fits the broader Endpoint Denial of Service technique documented by MITRE ATT&CK as T1499, in which attackers degrade or prevent service availability by exhausting host or application resources rather than saturating network bandwidth. In this case, the attack targets the application stack directly, causing total service disruption through algorithmic complexity and CPU exhaustion. Maintainers fixed the issue by replacing the repeated copy-and-join loop with an index-based linear scan, and users are advised to upgrade to Shescape 2.1.14 or 3.0.1.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A GitHub Security Advisory disclosed a high-severity algorithmic complexity denial-of-service flaw in the Node.js library Shescape, where crafted inputs can trigger quadratic-time behavior in compose() and block the event loop through CPU exhaustion. The advisory states the issue was fixed and recommends upgrading to versions 2.1.14 or 3.0.1.
MITRE ATT&CK published technique T1499 for Endpoint Denial of Service, describing how adversaries degrade or block service availability by exhausting host resources or causing persistent crash conditions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvereports.com
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability in the Node.js sandboxing library **`isolated-vm`** allows guest JavaScript to escape its sandbox, corrupt host memory, and potentially achieve remote code execution. Tracked as **`GHSA-864f-rcv7-6rh4`** and awaiting a CVE, the flaw was disclosed by Endor Labs as a type confusion bug in **`ExternalCopy`** handling of the **`transferList`** option. Researchers said the issue stems from a time-of-check/time-of-use gap across two iterations of a JavaScript array, where attacker-controlled getters can return an `ArrayBuffer` during validation and a different value during unchecked use, leading to unsafe behavior in the host process. The bug affects **all versions through `7.0.0`**, with fixes released in **`6.2.0`** and **`7.0.1`**. Endor Labs demonstrated exploitation beginning with only a single **`ivm.Reference`** exposed to the sandbox, first triggering a controlled host crash and then hijacking host control flow to call a chosen libc function. The maintainer patched the issue by blocking JavaScript execution during the copy operation using **`v8::Isolate::DisallowJavascriptExecutionScope`**. The disclosure is especially significant because `isolated-vm` is widely used to run untrusted code despite longstanding project warnings that misuse of objects such as `Reference` and `ExternalCopy`, as well as unsafe handling of snapshots or `cachedData`, can undermine isolation and expose the main Node.js process.
Aug 24, 2026
A disclosure reported **13 vulnerabilities** in the `vm2` Node.js sandbox through version `3.11.7`, including seven rated **CVSS 10.0**. The flaws provide independent routes for untrusted JavaScript to escape the sandbox, potentially access the host Node.js process, and execute commands with its privileges. Reported attack surfaces include WebAssembly, `Buffer` memory, TLS configuration, module-resolution controls, Promise handling, typed-array prototypes, and NodeVM configuration validation; `vm2` version `3.11.8` reportedly remediates all 13 issues. No public exploit or CISA Known Exploited Vulnerabilities listing was known at publication. Organizations running untrusted code with `vm2` should upgrade to `3.11.8`, identify exposed deployments, and review whether the library is being relied on as a sole security boundary. vm2’s own security guidance warns that same-process JavaScript sandboxing is prone to newly discovered escape techniques and recommends defense in depth: avoid `nesting: true` and overly broad builtin-module access, enforce memory limits and buffer-allocation caps, and use separate processes, containers, VMs, or managed execution environments for fully untrusted workloads. NodeVM timeouts do not reliably stop infinite loops, and vm2 alone does not prevent all denial-of-service conditions.
Sep 17, 2026
A wave of disclosures has exposed multiple critical flaws in the Node.js sandbox library **vm2**, showing that untrusted JavaScript can break out of the sandbox and execute commands on the host. GitHub advisories describe several distinct escape paths affecting versions as old as `3.9.6` and, in some cases, up to `3.11.3`, including a breakout through Node.js `inspect`, a Promise species bypass that defeats an earlier patch, prototype pollution through vm2’s bridge to host intrinsic prototypes, and a `NodeVM` misconfiguration path where `nesting: true` lets code bypass `require: false` and load `vm2` recursively to reach modules such as `child_process`. Public proof-of-concepts show attackers recovering the host `process` object and invoking host commands, turning vm2 from a containment boundary into a route to full host compromise. Additional reporting and upstream changes indicate the problems are broader than a single bug. Semgrep documented a new sandbox escape, while vm2 maintainers added regression tests covering descriptor- and prototype-traversal techniques used to recover host constructors such as `Function`, `AsyncFunction`, and `GeneratorFunction`, as well as callback sanitization bypasses tied to Promise handling. A later roundup described five critical vulnerabilities with no practical configuration-based workaround for deployments that execute untrusted code, and urged upgrades to **vm2 `3.11.4` or later**. The advisory backlog on the project’s GitHub page shows a concentrated set of newly published sandbox escape, builtin bypass, and host code execution issues, underscoring that organizations relying on vm2 for isolation should treat affected environments as potentially compromised.
Jun 29, 2026