A critical vulnerability has been discovered in the isolated-vm library used with Node.js, allowing potential remote code execution on host systems. This vulnerability stems from a type confusion bug affecting the ExternalCopy function, which is responsible for copying data between isolated instances of the V8 JavaScript engine. Developers utilize isolated-vm to run untrusted JavaScript code in secure V8 Isolates, which traditionally prevents interference between different code executions on the same machine.
The problem arises from the way ExternalCopy handles data serialization and reconstruction. When transferring large data objects, such as ArrayBuffers, the function attempts to optimize performance by detaching the memory from the source and transferring it to the destination. However, a flaw in this process allows attackers to exploit a time-of-check/time-of-use (TOCTOU) weakness. By manipulating the data transfer process, attackers can dereference pointers they control, leading to potential crashes or hijacking of the host process control flow.
The vulnerability impacts any system running untrusted code in an isolate, particularly if a single reference is shared into it. This flaw can be triggered directly if host code passes an array influenced by external callers as a transfer list. EndorLabs identified and reported this issue, highlighting the risk of remote code execution if exploited successfully.
Patches to mitigate this vulnerability are available in isolated-vm versions 6.2.0 and 7.0.1. These updates prevent user JavaScript from executing during the data copy process, addressing the underlying issue in the C++ binding code responsible for value serialization. Developers are urged to update to these latest versions to secure their systems against potential exploitation.