Type Confusion in isolated-vm ExternalCopy Enables Full Guest-to-Host Escape

Endor Labs researcher Cristian-Alexandru Staicu disclosed the issue after tracing execution from an ivm.Reference capability granted by the host. The type confusion occurs during deserialization across the V8 isolate boundary, allowing controlled-address writes that escalate to arbitrary memory corruption. Project maintainer Marcel Laverdet confirmed the minimum impact is a reliable SIGSEGV denial-of-service and the maximum is host control-flow hijack. Patches landed in 6.2.0 and 7.0.1 after roughly one million weekly downloads of the package.

The V8 Isolate primitive itself remained intact; failure occurred in the C++ binding layer that marshals objects. This pattern recurs across Node.js native addons where serialization assumptions break under attacker-controlled input. The library's design intentionally prevents direct object sharing between isolates, yet the ExternalCopy path introduced a trust boundary violation identical to past issues in vm2 and other sandbox wrappers.

Applications that embed isolated-vm to run untrusted code, including payment processors and transaction validators that isolate card-handling logic, now face eroded isolation guarantees. A successful escape could expose host memory containing PAN data or session keys, turning a contained script into a vector for card-data exfiltration or relay-style attacks on contactless flows.

Maintainers withheld full exploit details. Developers should audit any code path that passes ivm.Reference objects and migrate to the patched releases immediately. Future reviews must target the binding layer rather than the Isolate boundary.