TLDR Tech / InfoSec
GHSA-864f-rcv7-6rh4: Critical Type Confusion Vulnerability in isolated-vm
Endor Labs found a type confusion bug in isolated-vm's ExternalCopy transferList handling. A getter returns different values across two validation walks, letting attacker code pass a bad pointer through an unchecked cast. From one shared ivm.Reference, researchers reached the ExternalCopy constructor, crashed the host with SIGSEGV, then built a working exploit that recovers ASLR base, forges a vtable, and redirects an indirect call to invoke a chosen libc function. The vulnerability affects isolated-vm versions below 7.0.1 and 6.2.0, used by n8n, Activepieces, Mastra, Budibase, Directus, and Rocket.Chat. Upgrade immediately and audit which capabilities you pass into any sandboxed Reference.
Read the full story