Reported by 2 outlets
Critical Node.js Sandbox Flaw Exposes AI Agents to Host Code Execution
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.60 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Critical Node.js Sandbox Flaw Exposes AI Agents to Host Code Execution
cyberpress.org · 50d ago · August 24th, 2026
A critical vulnerability in the Node.js sandboxing library, isolated-vm, has exposed a serious risk to AI agents, automation platforms, and applications that execute untrusted JavaScript. The flaw, tracked as GHSA-864f-rcv7-6rh4, is a type confusion issue that can enable code running inside a sandbox to crash or potentially seize control of the host process. Cris Staicu said the affected package receives more than 1 million downloads per week and is widely used by developers who need to isolate user-supplied or model-generated code. Critical Node.js Sandbox Flaw Fixed releases are available, but organizations relying on earlier versions should treat this as an urgent patching priority. The vulnerability exists in ExternalCopy, a feature that moves serialized values between separate V8 Isolates. An Isolate normally provides a strong boundary: it has its own heap, built-ins, and object graph, so sandboxed code cannot access host resources unless the application intentionally grants a capability. ExternalCopy supports a transferList option for moving ArrayBuffers without copying their underlying memory. During processing, however, isolated-vm validated transfer-list entries during one pass and transferred them in a second pass. An attacker could use a JavaScript getter to return a real ArrayBuffer during validation, then return a different value when native transfer logic ran again. That mismatch created a time-of-check, time-of-use condition in the C++ binding layer rather than
-
update from gbhackers.com
Critical isolated-vm Flaw Lets Attackers Escape Sandbox and Hijack Host Control Flow
gbhackers.com · 50d ago · August 24th, 2026
It affects isolated-vm versions before 7.0.1 and 6.2.0. Researchers have […] The post Critical isolated-vm Flaw Lets Attackers Escape Sandbox and Hijack Host Control Flow appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .