Loading story…
A critical vulnerability in the Node.js sandboxing library isolated-vm allows guest JavaScript to escape its sandbox, corrupt host memory, and potentially achieve remote code execution. Tracked as GHSA-864f-rcv7-6rh4 and awaiting a CVE, the flaw was disclosed by Endor Labs as a type confusion bug in ExternalCopy handling of the transferList option. Researchers said the issue stems from a time-of-check/time-of-use gap across two iterations of a JavaScript array, where attacker-controlled getters can return an ArrayBuffer during validation and a different value during unchecked use, leading to unsafe behavior in the host process.
The bug affects all versions through 7.0.0, with fixes released in 6.2.0 and 7.0.1. Endor Labs demonstrated exploitation beginning with only a single ivm.Reference exposed to the sandbox, first triggering a controlled host crash and then hijacking host control flow to call a chosen libc function. The maintainer patched the issue by blocking JavaScript execution during the copy operation using v8::Isolate::DisallowJavascriptExecutionScope. The disclosure is especially significant because isolated-vm is widely used to run untrusted code despite longstanding project warnings that misuse of objects such as Reference and ExternalCopy, as well as unsafe handling of snapshots or cachedData, can undermine isolation and expose the main Node.js process.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
The isolated-vm maintainer fixed the vulnerability in versions 6.2.0 and 7.0.1 by wrapping ExternalCopy::Copy with v8::Isolate::DisallowJavascriptExecutionScope. The change prevents JavaScript execution during the copy operation, blocking the getter-based time-of-check/time-of-use exploit path.
Researchers showed exploitation starting with only a single ivm.Reference exposed to the sandbox, first triggering a controlled SIGSEGV crash and then escalating to host control-flow hijacking via attacker-controlled memory. They reported a path toward remote code execution while noting the V8 Isolate boundary itself was not broken.
Endor Labs disclosed a critical vulnerability in isolated-vm, tracked as GHSA-864f-rcv7-6rh4 and pending CVE assignment. The bug is a type confusion in ExternalCopy's transferList handling that can let sandboxed code corrupt host memory and escape to the host process.
The isolated-vm project documentation states that the library is in maintenance mode and warns that using it to run untrusted code is not inherently safe. The maintainer documents risks including process crashes, hangs, unsafe object exposure, and arbitrary code execution risks from snapshots or cachedData.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcesecurityweek.com
Open sourcethehackernews.com
Open sourceendorlabs.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed a broad set of critical flaws in the `vm2` Node.js sandbox library that allow untrusted JavaScript to break isolation and execute arbitrary code on the host system. Reports describe 11 to 12 vulnerabilities affecting versions across the `3.9.6` to `3.11.1` range, with most rated `CVSS 9.8` to `10.0`, and impacting core protections such as built-in allowlists, object handling, prototype traversal, Promise species behavior, `util.inspect`, `Module._load()`, WebAssembly exception handling, and unsafe `nesting: true` configurations. One tracked issue, **CVE-2026-24118**, is a sandbox breakout through `__lookupGetter__` in versions prior to `3.11.0`, enabling host-level command execution with no privileges or user interaction. The disclosures reinforce long-running concerns that `vm2`'s JavaScript-only isolation model is not dependable for high-risk use cases such as multi-tenant code execution, plugin evaluation, automated grading, and serverless workloads. While some reports recommend upgrading to **vm2 `3.11.2`** for the latest protections, others note that **CVE-2026-44008** and **CVE-2026-44009** remain unpatched and argue that organizations handling untrusted code should consider stronger isolation boundaries such as containers or microVMs. Successful exploitation could expose environment variables, credentials, and files, and enable full compromise of the underlying Node.js host and potential lateral movement.
Jun 29, 2026
A wave of disclosures has exposed multiple critical flaws in the Node.js sandbox library **vm2**, showing that untrusted JavaScript can break out of the sandbox and execute commands on the host. GitHub advisories describe several distinct escape paths affecting versions as old as `3.9.6` and, in some cases, up to `3.11.3`, including a breakout through Node.js `inspect`, a Promise species bypass that defeats an earlier patch, prototype pollution through vm2’s bridge to host intrinsic prototypes, and a `NodeVM` misconfiguration path where `nesting: true` lets code bypass `require: false` and load `vm2` recursively to reach modules such as `child_process`. Public proof-of-concepts show attackers recovering the host `process` object and invoking host commands, turning vm2 from a containment boundary into a route to full host compromise. Additional reporting and upstream changes indicate the problems are broader than a single bug. Semgrep documented a new sandbox escape, while vm2 maintainers added regression tests covering descriptor- and prototype-traversal techniques used to recover host constructors such as `Function`, `AsyncFunction`, and `GeneratorFunction`, as well as callback sanitization bypasses tied to Promise handling. A later roundup described five critical vulnerabilities with no practical configuration-based workaround for deployments that execute untrusted code, and urged upgrades to **vm2 `3.11.4` or later**. The advisory backlog on the project’s GitHub page shows a concentrated set of newly published sandbox escape, builtin bypass, and host code execution issues, underscoring that organizations relying on vm2 for isolation should treat affected environments as potentially compromised.
Jun 29, 2026
The `vm2` Node.js sandboxing library was hit by a wave of critical sandbox-escape vulnerabilities that let attackers executing untrusted JavaScript break out and run arbitrary commands on the host. Reported flaws include CVE-2026-24120, which bypasses an earlier Promise-species mitigation to reach the host `Function` constructor; CVE-2026-24118, which abuses `__lookupGetter__`, `Buffer.apply`, and prototype traversal; CVE-2026-24781, which leverages `inspect` proxy unwrapping; CVE-2026-26332, which pivots through `SuppressedError`; and CVE-2026-26956, which uses WebAssembly `JSTag` exception handling on Node.js 25+. Across the advisories, affected versions span the `3.10.x` branch and earlier, with several issues requiring only the ability to submit code to a vm2 instance and no authentication or user interaction. The project responded with security releases `v3.10.5` and `v3.11.0`, with `v3.11.0` closing 13 advisories including sandbox escapes, denial-of-service bugs, information disclosure, and prototype pollution. Maintainers also patched a separate `NodeVM` issue tracked as `GHSA-m4wx-m65x-ghrr`, where enabling `nesting: true` with omitted or falsy `require` settings could expose the `vm2` package inside the sandbox and lead to host remote code execution. The releases added broader hardening measures such as `bufferAllocLimit`, stricter handling of dangerous built-ins, and filesystem checks, while maintainers warned that organizations using vm2 to run fully untrusted code should upgrade immediately and avoid treating in-process JavaScript sandboxing as a sole security boundary.
Jun 29, 2026