Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Isolated-vm ExternalCopy type confusion GHSA-864f-rcv7-6rh4 remote code execution flaw

Vulnerability
First reported
Last updated
Happening score
H score 16
1 unique sources, 1 articles

Summary

Hide ▲

isolated-vm users face a critical ExternalCopy type confusion flaw that can let sandboxed JavaScript escape into the host process and corrupt memory across all versions through 7.0.0. The bug can crash the host with SIGSEGV and, in the maximum demonstrated case, reach control-flow hijack with potential remote code execution. Patched releases 6.2.0 and 7.0.1 are available, and earlier versions should be updated.

Related Happenings

Linux Netfilter conntrack direction-validation flaw (CVE-2026-63913)

Vulnerability
H score23 First: 07.08.2026 12:32 Last: 07.08.2026 12:32 Sources 1

About this happening: CVE-2026-63913 in Linux Netfilter conntrack lets a crafted SYN plus invalid reset packet prematurely close a NAT entry, creating session-state manipulation risk for af...

Open Happening

Linux kernel GhostLock root privilege escalation (CVE-2026-43499)

Vulnerability
H score28 First: 08.07.2026 09:16 Last: 08.07.2026 09:16 Sources 1

About this happening: Researchers disclosed GhostLock (CVE-2026-43499), a Linux kernel use-after-free that can let a logged-in local user gain full root control on unpatched systems. Th...

Open Happening

Linux KVM shadow MMU use-after-free security flaw (CVE-2026-53359)

Vulnerability
H score34 First: 06.07.2026 20:37 Last: 06.07.2026 20:37 Sources 1

About this happening: CVE-2026-53359 is a Linux KVM shadow MMU use-after-free that a guest VM can trigger to corrupt host kernel shadow-page state, creating host panic and poten...

Open Happening

Vm2 Node.js sandbox escape and RCE vulnerabilities (CVE-2026-24118)

Vulnerability
H score39 First: 07.05.2026 07:15 Last: 07.05.2026 07:15 Sources 1

About this happening: vm2 now has multiple critical vulnerabilities that can let attacker-controlled JavaScript escape the sandbox and reach the host, creating arbitrary code execution...

Open Happening

Vm2 Node.js sandbox escape (CVE-2026-26956)

Vulnerability
H score29 First: 06.05.2026 21:38 Last: 06.05.2026 21:38 Sources 1

About this happening: A PoC exploit for CVE-2026-26956 now exposes vm2 3.10.4 deployments to arbitrary code execution on the host. The flaw may also affect earlier vm2 releases, but...

Open Happening

Timeline

  1. 20.08.2026 16:48 2 articles · 2h ago

    Researchers disclose critical isolated-vm sandbox escape flaw

    Initial Disclosure

    Researchers disclosed a critical flaw in isolated-vm, a Node.js sandbox library, where a type confusion in ExternalCopy's handling of transferList can let sandboxed JavaScript escape into the host process, corrupt host memory, and trigger SIGSEGV crashes; the issue affects versions before and including 7.0.0 and has been patched in 6.2.0 and 7.0.1.

    Show sources
    Open in new tab