A critical sandbox escape vulnerability was discovered and patched in isolated-vm, a library for running JavaScript code inside an isolated process. If exploited, the vulnerability could allow attackers to hijack the host’s control flow, which could enable remote code execution.
Isolated-vm is downloaded more than 1 million times per week and is also used as a direct or optional component in other projects, including open-source AI agent automation frameworks such as n8n, Sim.ai, Mastra, and Activepieces. Its goal is to execute untrusted user-provided JavaScript code inside a sandbox created with the Isolate feature in V8, the JavaScript engine from Chrome and Node.js.
“Running untrusted JavaScript safely is one of the hardest problems in the Node.js ecosystem, and its history is littered with failures,” said Cris Staicu, lead researcher at appsec firm Edor Labs, who found the vulnerability. “Vm2, for years the default answer, accumulated more than twenty documented breakouts before being deprecated.”
Click Here For The Original Source.
