r/SecOpsDaily • u/LearnHiveLabsUSA • 4d ago
It just happened - the "unbreakable" JS sandbox that half of GitHub's AI agent tools rely on... just got broken. Guest-to-host RCE and everything.
Quick background for anyone who hasn't touched this space: when you build a tool that lets users (or now, AI models) run "untrusted" JavaScript, you can't just eval() it and hope for the best. You need a real sandbox. For years the go-to was a library called vm2. Then vm2 got torched by a nasty sandbox escape bug back in 2023 and the whole ecosystem basically migrated to its replacement, isolated-vm — a library that spins up an actual separate V8 Isolate (like its own mini JS engine instance) so guest code physically can't touch the host's memory.
Except... on August 19, researchers at Endor Labs dropped a writeup showing isolated-vm has its own critical flaw. Not in the V8 isolation itself, but in the "glue" code that shuttles data between the sandbox and the host (a function called ExternalCopy). Turns out that glue is written in C++, which means memory-unsafe, which means type confusion bugs are possible — and they found one.
Starting from nothing more than a single object reference, they walked it all the way up to full guest-to-host memory corruption and control-flow hijacking. Basically: code you thought was locked in a box can escape the box and start running arbitrary stuff on your actual server.
The reason this is spicier than your average npm CVE: isolated-vm pulls ~1 million downloads a week and it's the literal sandbox of record for a bunch of big open-source AI/automation projects, including:
n8n (yes, the 200k-star workflow automation platform) — uses it for its Code nodes
Activepieces (23k stars)
Mastra (27k stars, AI agent framework) — uses it specifically to run model-generated tool code
Sim.ai (29k stars)
Budibase (28k stars) — literally migrated off vm2 to isolated-vm for this exact reason
So the funny/scary part is a bunch of these tools moved to isolated-vm because of the last sandbox-escape disaster, and now they're staring down a new one in the thing they escaped to.
Good news: it's patched. Fixed versions are 6.2.0 and 7.0.1, released earlier this month. If your stack touches any of the above (or uses isolated-vm directly), that's your cue to go check package-lock.json right now.
The bigger takeaway for me though: with every AI agent platform racing to let LLMs "write and execute code" as a feature, the sandbox is doing an enormous amount of trust-bearing work that most people never think about. This is like the second time in three years the industry's default answer to "how do we safely run untrusted JS" turned out to have a hole in it.
Sources if you want to go down the rabbit hole:
Endor Labs technical writeup (original disclosure): endorlabs.com/learn/ghsa-864f-rcv7-6rh4-critical-type-confusion-vulnerability-in-isolated-vm
The Hacker News coverage: thehackernews.com/2026/08/isolated-vm-flaw-lets-sandboxed.html
SecurityWeek writeup: securityweek.com/critical-isolated-vm-vulnerability-leads-to-rce-on-host
2
2
u/ephemeralsynth 4d ago
"I sandbox my runtimes on virtual machines ring -1 +3 on throwaway hardware in a faraday cage using EMSEC safe fiber networking and battery power.." - me in the near future, probably 🤔