A critical type-confusion and time-of-check/time-of-use (TOCTOU) vulnerability, tracked as GHSA-864f-rcv7-6rh4 and awaiting a CVE identifier, has been identified in the popular Node.js sandboxing library isolated-vm. The flaw affects versions earlier than 7.0.1 and 6.2.0, with security fixes released by the maintainers on August 8, 2026. Isolated-vm uses V8 Isolates to execute untrusted JavaScript in separated environments, preventing sandboxed code from directly accessing host objects unless specific capabilities, such as an ivm.Reference, are intentionally exposed. Researchers determined that the V8 isolation mechanism itself is not broken; instead, the vulnerability resides in the native C++ binding code responsible for transferring data between isolates through the ExternalCopy feature.

The vulnerability specifically involves the transferList option of ExternalCopy, which allows ArrayBuffer memory to be transferred instead of copied for better performance. The affected native code processes the transfer list twice: during the first pass, it verifies that each entry is an ArrayBuffer, but during the second pass, it transfers the entries without performing the same type validation. An attacker can exploit this behavior using a JavaScript getter that returns a legitimate ArrayBuffer during the initial validation but changes its return value to an unexpected type, such as an integer or string, during the second access. The native code then performs an unchecked conversion and treats the unexpected value as an ArrayBuffer, creating a type-confusion condition and allowing attacker-controlled data to cross the isolation boundary in an unsafe manner.

Exploitation can begin entirely from inside the sandbox when only a single ivm.Reference is exposed by the host. By retrieving the ExternalCopy constructor through the reference, malicious JavaScript can construct the specially crafted transfer list without requiring direct host access. The immediate impact can be a reliable crash of the host process, resulting in denial of service, while Endor Labs demonstrated that exploitation can potentially be escalated to control-flow hijacking and arbitrary code execution outside the sandbox. This makes the vulnerability particularly serious for multi-tenant applications, AI agent platforms, workflow automation systems, user-script execution services, and other environments that execute untrusted or model-generated JavaScript.

The vulnerability was fixed by changing ExternalCopy so that JavaScript execution is prevented while the sensitive copy/transfer operation is performed, preventing getters, proxies, and similar JavaScript mechanisms from modifying values between validation and use. Organizations using isolated-vm should immediately upgrade to version 7.0.1 or 6.2.0, depending on their supported release branch. Security teams should also minimize the capabilities and references exposed to sandboxed code, review applications that execute untrusted JavaScript, and audit native C++ binding layers for similar validation gaps. The incident demonstrates that even when the underlying V8 sandbox provides strong isolation, unsafe native glue code surrounding the isolation boundary can undermine that protection and potentially allow sandbox escape and host-level code execution.