Critical flaw patched in popular JavaScript sandbox used in AI projects

A critical sandbox escape vulnerability was discovered and patched in isolated-vm, a library for running JavaScript code inside an isolated process. If exploited, the vulnerability could allow attackers to hijack the host’s control flow, which could enable remote code execution.

Isolated-vm is downloaded more than 1 million times per week and is also used as a direct or optional component in other projects, including open-source AI agent automation frameworks such as n8n, Sim.ai, Mastra, and Activepieces. Its goal is to execute untrusted user-provided JavaScript code inside a sandbox created with the Isolate feature in V8, the JavaScript engine from Chrome and Node.js.

“Running untrusted JavaScript safely is one of the hardest problems in the Node.js ecosystem, and its history is littered with failures,” said Cris Staicu, lead researcher at appsec firm Edor Labs, who found the vulnerability. “Vm2, for years the default answer, accumulated more than twenty documented breakouts before being deprecated.”

But isolated-vm takes a different architectural approach and relies on V8’s Isolate, the same primitive that Google Chrome uses to isolate code running in different browser tabs. That is a strong and well tested mechanism, critical to browser security.

But this vulnerability, which Endor Labs describes as a type confusion, was located in the library’s C++ glue code that carries data into V8, not in the isolation mechanism itself.

“A perfectly sound building block was undermined by the binding layer wrapped around it,” Staicu said. “As AI agents and automation platforms make untrusted-code execution a mainstream requirement, the binding layer around your sandbox deserves first-class security attention.”

The isolated-vm developers promptly patched the vulnerability in versions 7.0.1 and 6.2.0, released earlier this month. However, the security advisory along with details about the flaw were made public today.