<![CDATA[🔴 Critical: Isolated-vm Flaw Lets Sandboxed JavaScript Escape to Host for Potential RCE]]>Researchers have disclosed a critical vulnerability in isolated-vm, a widely used open-source JavaScript sandbox with over 2,900 GitHub stars and 190 forks. The flaw allows an attacker to escape the sandboxed environment and potentially achieve code execution on the host system.

The issue, tracked as GHSA-864f-rcv7-6rh4, has not yet been assigned a CVE identifier. It affects all versions of the library up to and including 7.0.0.

  • Impacted: All isolated-vm versions before and including 7.0.0
  • Type: Sandbox escape leading to potential remote code execution (RCE)
  • Status: No CVE assigned yet; advisory available via GitHub

Given the library's popularity in Node.js applications for running untrusted code, developers relying on isolated-vm for security boundaries should monitor upstream releases closely and apply patches as soon as they become available. This vulnerability highlights the inherent risk of relying solely on sandboxing mechanisms without additional layers of isolation.

Source: The Hacker News

Is your team currently using isolated-vm in production, and how are you planning to mitigate this while waiting for an official patch?

]]>https://xploitlk.com/topic/73/critical-isolated-vm-flaw-lets-sandboxed-javascript-escape-to-host-for-potential-rceRSS for NodeSat, 05 Sep 2026 13:30:28 GMTSun, 23 Aug 2026 18:30:22 GMT60