🔴 Critical: Isolated-vm Flaw Lets Sandboxed JavaScript Escape to Host for Potential RCE
-
Researchers have disclosed a critical vulnerability in isolated-vm, a widely used open-source JavaScript sandbox with over 2,900 GitHub stars and 190 forks. The flaw allows an attacker to escape the sandboxed environment and potentially achieve code execution on the host system.
The issue, tracked as GHSA-864f-rcv7-6rh4, has not yet been assigned a CVE identifier. It affects all versions of the library up to and including 7.0.0.
- Impacted: All isolated-vm versions before and including 7.0.0
- Type: Sandbox escape leading to potential remote code execution (RCE)
- Status: No CVE assigned yet; advisory available via GitHub
Given the library's popularity in Node.js applications for running untrusted code, developers relying on isolated-vm for security boundaries should monitor upstream releases closely and apply patches as soon as they become available. This vulnerability highlights the inherent risk of relying solely on sandboxing mechanisms without additional layers of isolation.
Source: The Hacker News
Is your team currently using isolated-vm in production, and how are you planning to mitigate this while waiting for an official patch?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login