InfoSec News Nuggets – 08/21/2026
Brief
Isolated-vm Flaw Lets Sandboxed JavaScript Escape to Host for Potential RCE
Researchers at Endor Labs disclosed a critical vulnerability in isolated-vm, a popular open-source sandbox with nearly a million weekly npm downloads used to run untrusted JavaScript inside an isolated V8 engine instance.
A type confusion bug in how the library’s ExternalCopy feature handles a transfer option lets code running inside the sandbox corrupt memory in the host process, and researchers demonstrated escalating that corruption all the way to a full guest-to-host sandbox escape starting from nothing but a single standard object reference.