A critical type confusion flaw in the isolated-vm Node.js library could let attackers achieve remote code execution on the host by abusing the ExternalCopy transfer process across V8 isolates. The issue affects embedders running untrusted JavaScript with shared References and was fixed in isolated-vm versions 6.2.0 and 7.0.1. #isolated-vm #ExternalCopy #V8 #Nodejs
Keypoints
- A critical type confusion bug exists in the isolated-vm Node.js library.
- The flaw affects the ExternalCopy function used to transfer data between V8 isolates.
- An attacker can abuse a TOCTOU weakness in the transferList handling.
- Exploitation may cause a crash or allow control-flow hijacking on the host process.
- Versions 6.2.0 and 7.0.1 include patches that prevent user JavaScript from running during the copy.
Read More: https://www.securityweek.com/critical-isolated-vm-vulnerability-leads-to-rce-on-host/