Critical isolated-vm flaw enables remote code execution on host
This digest was compiled by AI from multiple sources — links to the originals are below.
A critical type confusion vulnerability in the isolated-vm Node.js library allows remote code execution on the host system. The flaw, which lacks a CVE identifier, affects ExternalCopy, the function used to copy data across Isolates. Patches are available in isolated-vm versions 6.2.0 and 7.0.1.
Key Facts
- The vulnerability is a type confusion in ExternalCopy, the function used to copy data across Isolates.
- Patches were included in isolated-vm versions 6.2.0 and 7.0.1 to prevent user JavaScript from running during the copy.
- Successful exploitation leads to a crash or control-flow hijack of the host process, potentially enabling remote code execution.
- Any embedder that runs untrusted code in an isolate and shares even one Reference into it is affected.
Vulnerability Details
The flaw is a type confusion in ExternalCopy, the function used to copy data across Isolates. ExternalCopy serializes data in one Isolate and reconstructs it in the other instance. For performance optimization, it uses a transferList: large ArrayBuffers are listed, and the underlying memory is transferred by detaching the buffer from the source and handing it to the destination. The reconstructor iterated over the byte array list twice, with the second pass trusting the first walk. Because iterating the transfer_list JavaScript array would not return the same value for an element defined as a getter for each pass, an attacker could abuse the time-of-check/time-of-use weakness to dereference an attacker-controlled pointer.
Exploitation and Impact
While the ExternalCopy constructor is only accessible from the host, a guest can target ivm.Reference, the mechanism through which the host exposes anything to the sandbox, to build the malicious transferList and trigger the vulnerability. Successful exploitation leads to a crash (denial-of-service) or control-flow hijack of the host process, which potentially enables remote code execution on the host. Any embedder that runs untrusted code in an isolate and shares even one Reference into it is affected. Host code that passes a caller-influenced array as transferList is affected directly, without any guest.
Patch and Mitigation
Patches for the vulnerability were included in isolated-vm versions 6.2.0 and 7.0.1 to prevent user JavaScript from running during the copy. The vulnerability lived in the native glue code: the C++ binding that serializes values across the boundary. That layer is written in a memory-unsafe language; it manipulates raw V8 handles and backing-store pointers, and it re-reads attacker-controlled JavaScript objects in the middle of a security-sensitive operation. A single unchecked cast on a re-read value was enough to turn a correct isolation primitive into a full escape.
1 source
Critical isolated-vm flaw enables remote code execution on host
