Critical Vulnerability in isolated-vm Node.js Library Allows Remote Code Execution

Vulnerability in isolated-vm Library

A critical-severity type confusion vulnerability has been identified in the isolated-vm Node.js library. This flaw could enable threat actors to achieve remote code execution (RCE) on the host system where the library is used. The vulnerability affects the ExternalCopy function, which is responsible for copying data between V8 Isolates.

How isolated-vm Works

The isolated-vm library provides access to the V8 JavaScript engine's Isolate interface, allowing developers to create isolated JavaScript environments. Each Isolate functions as a separate V8 instance with its own heap memory, execution state, and garbage collector. This setup is commonly used for executing untrusted JavaScript code in a sandboxed environment without requiring containers or virtual machines.

Exploitation Mechanism

The type confusion bug occurs within the ExternalCopy function, which serializes data in one Isolate and reconstructs it in another. For performance, it uses a transferList to move large ArrayBuffers by detaching them from the source and attaching them to the destination. The vulnerability arises because the reconstructor iterates over the byte array list twice, trusting the first pass. An attacker can exploit a time-of-check/time-of-use (TOCTOU) weakness by defining a getter for an element in the transfer_list JavaScript array that returns different values on each pass, leading to dereferencing an attacker-controlled pointer. While the ExternalCopy constructor is host-accessible, a guest can target ivm.Reference to construct a malicious transferList and trigger the vulnerability.

Impact and Resolution

Successful exploitation of this security defect can result in a crash (denial-of-service) or a control-flow hijack of the host process, potentially enabling RCE. Any embedder running untrusted code in an Isolate and sharing even one Reference into it is affected. Host code that passes a caller-influenced array as transferList is directly affected. Patches addressing this vulnerability were included in isolated-vm versions 6.2.0 and 7.0.1, preventing user JavaScript from running during the copy operation.