A significant security vulnerability has been identified in the isolated-vm Node.js library, which could allow sandboxed JavaScript code to escape its intended isolation and potentially achieve arbitrary code execution on the host system. The flaw specifically impacts the ExternalCopy component of the library.
The vulnerability stems from memory corruption issues within the ExternalCopy component, which is responsible for facilitating data transfer across the isolation boundaries. This corruption can lead to control-flow hijacking, effectively allowing malicious code to break out of the JavaScript sandbox. While the core isolation primitive provided by isolated-vm is reported to remain sound, the C++ binding layer that implements the data transfer mechanism was found to be susceptible to this issue.
The isolated-vm library is designed to execute untrusted JavaScript code in a secure, isolated environment, often used in applications that process user-supplied scripts or run third-party code. The ExternalCopy component's role is critical in allowing data to be safely exchanged between the isolated VM and the host Node.js process. A flaw in this component undermines the integrity of that exchange, creating an avenue for escape.
Successful exploitation of such a vulnerability typically involves crafting malicious JavaScript code that, when executed within the isolated-vm sandbox, triggers the memory corruption in the ExternalCopy component. This corruption can then be leveraged to manipulate program execution flow on the host, potentially leading to remote code execution (RCE) if the vulnerable application is exposed over a network.
For users of the isolated-vm library, immediate action is recommended. Patches addressing this vulnerability have been released and are available in versions 6.2.0 and 7.0.1 of the library. Developers are advised to update their dependencies to these or newer versions to mitigate the risk of exploitation.
This class of vulnerability, often involving a sandbox escape, highlights the persistent challenges in securing complex software environments that integrate multiple languages or execution contexts. While sandboxing is a fundamental security control, the interfaces and binding layers between sandboxed and host environments frequently present attack surfaces that require rigorous scrutiny and robust error handling to prevent memory corruption and control-flow hijacking.
