Critical Type Confusion in isolated-vm ExternalCopy Enables Guest-to-Host Sandbox Escape and RCE (GHSA-864f-rcv7-6rh4)

Critical Type Confusion in isolated-vm ExternalCopy Enables (TL-2026-2084), also tracked as GHSA-864f-rcv7-6rh4, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-08-20. It has no confirmed attribution, affects npm / open-source isolated-vm, maps to 8 MITRE ATT&CK techniques (T1027, T1055, T1057), and is covered by 9 detection rules and 7 indicators of compromise.

Key facts for TL-2026-2084

Threat ID
TL-2026-2084
Also known as
GHSA-864f-rcv7-6rh4
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-08-20
Last reviewed
2026-08-20
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
technology, automation, devops, software-development, cloud-computing, ecommerce, travel, internet-infrastructure
Target regions
Global
Detection rules
9
Indicators of compromise
7

A critical type confusion vulnerability (GHSA-864f-rcv7-6rh4, CVE pending) in the isolated-vm npm library's ExternalCopy class allows JavaScript code running inside a V8 Isolate sandbox to escape into the host Node.js process. The root cause is a TOCTOU (Time-of-Check/Time-of-Use) gap in the C++ native binding code: the transferList JavaScript array is iterated twice, and a getter can return different values on each read, causing an unchecked reinterpret_cast to dereference an attacker-controlled pointer. Researchers at Endor Labs escalated this from a controlled crash to a full control-flow hijack of the host process, establishing RCE from inside the sandbox with only a single ivm.Reference.

How Critical Type Confusion in isolated-vm ExternalCopy Enables works

## Vulnerability Overview

GHSA-864f-rcv7-6rh4 is a critical type confusion vulnerability in the `ExternalCopy` class of `isolated-vm`, the most widely used V8-Isolate-based JavaScript sandbox library for Node.js (1M+ weekly downloads, 273 dependents). Discovered by Cristian-Alexandru Staicu of Endor Labs, the bug resides in the C++ native binding code that marshals values across the V8 Isolate boundary — not in V8's isolation primitive itself.

## Root Cause: TOCTOU in ExternalCopy transferList

The `ExternalCopy` constructor (`src/external_copy/serializer.cc`) iterates the `transferList` JavaScript array **twice**:

1. **Walk 1 (Validation):** Checks each element with `IsArrayBuffer()` and registers valid entries with the serializer. 2. **Walk 2 (Transfer):** Calls `handle.As<ArrayBuffer>()` — an **unchecked reinterpret_cast** — to transfer each element without re-validating.

Because array element access invokes JavaScript accessors (`Get()`), an attacker-defined **getter** can return a valid `ArrayBuffer` on the first read and an attacker-controlled value (e.g., the small integer `0x41414141`) on the second read. The `As<ArrayBuffer>()` cast treats the fake value as an `ArrayBuffer*`, causing the host process to dereference attacker-controlled memory.

## Exploitation Chain: Crash → ASLR Bypass → Control-Flow Hijack

The Endor Labs researchers developed a full exploit chain working entirely from inside the sandbox with only a single `ivm.Reference` — the standard mechanism hosts use to expose capabilities to sandboxes:

### Stage 1: Controlled Crash Primitive The PoC crashes Node.js 26.5.0 on macOS/arm64 with `SIGSEGV` at address `0x4141414100000047`. The `ExternalCopyArrayBuffer::Transfer` function (`src/external_copy/external_copy.cc:397`) calls `IsDetachable()` and `GetBackingStore()` on the confused pointer.

### Stage 2: ASLR Bypass By controlling the bytes read as the object's fields (a JavaScript string instead of an integer), the researcher recoverd the **host's ASLR base** through leaked pointers — no separate infoleak vulnerability was required.

### Stage 3: VTable Forging → Control-Flow Hijack The exploit forges a fake control block and vtable in heap-sprayed memory and drives an indirect call to an address of its choosing. The `shared_ptr` destruction path does an indirect call through a vtable pointer read from attacker-controlled memory. This was demonstrated by making the host process invoke a chosen libc function.

The full exploit is withheld from public disclosure.

## The Fix

The maintainer patched both affected version lines by wrapping `ExternalCopy::Copy` in a `v8::Isolate::DisallowJavascriptExecutionScope` (`THROW_ON_FAILURE`), which prevents any user JavaScript (getters, proxies, interceptors) from running during the copy operation, eliminating the TOCTOU window entirely.

- **v7.0.1** (commit `38e244b`) — 1 line added, 0 removed in `src/external_copy/external_copy.cc` - **v6.2.0** (commit `c1cfe9f`) — same patch backported

## Affected Ecosystem

isolated-vm is a dependency of major open-source platforms that run untrusted JavaScript in sandboxed environments:

- **n8n** (200k GitHub stars) — Integrated via `IsolatedVmBridge` (PR #26142, Feb 2026) for expression evaluation inside V8 isolates (128 MB limit) - **Activepieces** (23k stars) — `SANDBOX_CODE_ONLY` mode uses isolated-vm for JS automation pieces - **Mastra AI** (27k stars) — Dedicated `@mastra/isolated-vm` transport (`IsolatedVmCodeModeTransport`) for AI-authored code execution - **Budibase** (28k stars) — Migrated from vm2 to isolated-vm in v2.20.0 (PR #12769) - **Directus** (37k stars) — Replaced vm2 for Run Script Flows in v10.6.0 (PR #19332) - **Sim.ai / Sim Studio** (29k stars) — AI agent code execution in isolated workers - **Rocket.Chat** (46k stars) — Secure mode for webhook integration scripts (PR #30229) - **Screeps** — MMO game running player-submitted AI code; original use case for the library - **Fly.io** — Edge middleware running globally distributed applications - **Algolia** — Custom Crawler product for user-provided content extraction - **TripAdvisor** — Server-side rendering of React pages at scale

## Previous CVEs in isolated-vm

This is the third critical vulnerability in isolated-vm, highlighting a pattern of C++ native binding risks: - **CVE-2021-21413** (GHSA-mmhj-4w6j-76h7, CVSS 9.6): Reference prototype chain traversal in pre-v4.0.0 - **CVE-2022-39266** (GHSA-2jjq-x548-rhpv, CVSS 9.8): Untrusted V8 CachedData bypass in ≤4.3.6 - **GHSA-864f-rcv7-6rh4** (CVE pending, Critical): This TOCTOU type confusion in ExternalCopy

All three share a root pattern: the bug lives in the **C++ binding/glue layer** that marshals values across the V8 Isolate boundary, not in V8's isolation primitive itself.

## Key Lesson

As the Endor Labs researchers emphasize, the V8 Isolate boundary itself held. What failed was the C++ glue code that marshals values across that boundary. This is framed as a recurring security pattern: safe isolation primitives are undermined by memory-unsafe binding layers wrapped around them. The researchers' prior academic work — **SandDriller** (USENIX Security 2023) for automated sandbox seam testing and **Bilingual Problems** (USENIX Security 2023) for native extension memory unsafety — directly informed this discovery.

MITRE ATT&CK techniques used in TL-2026-2084

Defense Evasion

T1027 Obfuscated Files or Information; T1055 Process Injection

Discovery

T1057 Process Discovery; T1082 System Information Discovery

Execution

T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution

Command and Control

T1071 Application Layer Protocol

Impact

T1485 Data Destruction

Affected products and versions in Critical Type Confusion in isolated-vm ExternalCopy Enables

  • npm / open-source — isolated-vm
    Vulnerable versions: <=7.0.0; <=6.1.x
    Fixed in: 7.0.1; 6.2.0
  • n8n GmbH — n8n (workflow automation)
    Vulnerable versions: all versions using isolated-vm (IsolatedVmBridge)
    Fixed in: pending isolated-vm dependency bump
  • Activepieces Inc — Activepieces (automation platform)
    Vulnerable versions: all versions using SANDBOX_CODE_ONLY mode
    Fixed in: pending isolated-vm dependency bump
  • Mastra AI — @mastra/isolated-vm (AI agent transport)
    Vulnerable versions: all versions using IsolatedVmCodeModeTransport
    Fixed in: pending isolated-vm dependency bump
  • Budibase — Budibase (low-code platform)
    Vulnerable versions: all versions >=2.20.0 using isolated-vm
    Fixed in: pending isolated-vm dependency bump
  • Directus — Directus (headless CMS)
    Vulnerable versions: all versions >=10.6.0 using isolated-vm for Run Script Flows
    Fixed in: pending isolated-vm dependency bump

Remediation for Critical Type Confusion in isolated-vm ExternalCopy Enables

Patches

  • Upgrade to isolated-vm@7.0.1 (latest major) from npm
  • Backport to isolated-vm@6.2.0 for LST version line
  • Patch commit ref: github.com/laverdet/isolated-vm/commit/38e244b (v7.0.1)
  • Patch commit ref: github.com/laverdet/isolated-vm/commit/c1cfe9f (v6.2.0)

Immediate actions

  • Upgrade isolated-vm to version >=7.0.1 or >=6.2.0 immediately
  • Run `npm audit` or `pnpm audit` to identify all dependents using vulnerable isolated-vm versions
  • If upgrade is not immediately possible, audit all code paths that pass transferList to ExternalCopy with attacker-controlled input
  • Monitor for any CVE assignment and check NVD for eventual CVSS release
  • Review Node.js version requirements; v7.x requires Node >=24.0.0

Workarounds

  • Restrict the number of ivm.Reference objects shared into sandboxes — one Reference is sufficient to trigger the exploit
  • Avoid passing transferList with untrusted ArrayBuffer values to ExternalCopy
  • Wrap all isolated-vm usage in worker threads so a sandbox escape does not compromise the main process
  • Set process-level resource limits (memory, CPU) to contain blast radius of any sandbox escape

Longer-term hardening

  • Evaluate whether V8 Isolate sandboxing alone is sufficient for your threat model given repeated binding-layer vulnerabilities
  • Consider defense-in-depth: combine isolated-vm with OS-level sandboxing (Linux namespaces, seccomp)
  • For critical deployments, evaluate hardware-level isolation (QEMU microVMs) as additional layer
  • Implement runtime monitoring for suspicious patterns (getters on transferList, repeated reads of the same array index returning different types)
  • Conduct security reviews of all C++ native binding code that handles untrusted JavaScript objects

Weaknesses (CWE) in Critical Type Confusion in isolated-vm ExternalCopy Enables

CWE-843, CWE-367, CWE-704

Timeline of Critical Type Confusion in isolated-vm ExternalCopy Enables

  • isolated-vm package initially released on npm under ISC license by maintainer laverdet, providing V8 Isolate-based JavaScript sandboxing for Node.js
  • CVE-2021-21413 (GHSA-mmhj-4w6j-76h7, CVSS 9.6) disclosed — Reference prototype chain traversal allowed sandbox escape in isolated-vm pre-v4.0.0. Fixed in v4.0.0
  • CVE-2022-39266 (GHSA-2jjq-x548-rhpv, CVSS 9.8) disclosed — untrusted V8 CachedData could bypass the sandbox and execute arbitrary code in the Node.js process. Documentation fix in v4.3.7
  • USENIX Security 2023 published SandDriller (automated sandbox seam testing, by Alhamdan and Staicu) and Bilingual Problems (native extension risks in scripting languages, by Staicu et al.), the research foundations that informed this vulnerability discovery
  • Budibase migrated from vm2 to isolated-vm in v2.20.0 (PR #12769), citing vm2 discontinuation and critical security issues. Multiple other platforms followed, expanding isolated-vm's attack surface
  • n8n merged IsolatedVmBridge PR #26142, adding isolated-vm ^6.0.2 as a dependency for expression evaluation — 128 MB memory limit, lazy proxy data access. Part of a multi-PR security hardening effort
  • Endor Labs responsibly disclosed the vulnerability to the isolated-vm maintainer (laverdet) with full technical details and a working exploit demonstration achieving guest-to-host control-flow hijack
  • Cristian-Alexandru Staicu of Endor Labs discovered the TOCTOU type confusion vulnerability in isolated-vm's ExternalCopy transferList handling during systematic sandbox security research
  • isolated-vm v7.0.1 and v6.2.0 published to npm. The fix wraps ExternalCopy::Copy in a v8::Isolate::DisallowJavascriptExecutionScope (commits 38e244b and c1cfe9f) to prevent user JavaScript from running during the copy operation
  • GitHub Security Advisory GHSA-864f-rcv7-6rh4 published for isolated-vm, rated Critical, confirming all versions <=7.0.0 and <=6.1.x are affected. No CVSS score or CWE published in the advisory body
  • CISA KEV checked — no active exploitation in the wild confirmed for this vulnerability. No CVE assigned yet. Organizations advised to patch proactively given the severity and full exploit disclosure with PoC
  • The Hacker News published coverage of the vulnerability, reaching the broader cybersecurity community. Downstream affected projects (n8n, Activepieces, Mastra AI, Budibase, Directus, Rocket.Chat) notified and urged to upgrade their isolated-vm dependency
  • Endor Labs published the full technical disclosure blog post detailing the complete exploit chain: controlled crash primitive, ASLR bypass via leaked host pointers, heap spray for fake vtable, and control-flow hijack demonstrating libc function invocation from inside the sandbox

Sources cited for Critical Type Confusion in isolated-vm ExternalCopy Enables

Threats related to Critical Type Confusion in isolated-vm ExternalCopy Enables

Detection coverage for TL-2026-2084

As of 2026-08-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2084 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats