The Node.js Sandbox Your AI Agent Uses for Untrusted Code Has a Guest-to-Host Escape — Upgrade isolated-vm Now

TL;DR: isolated-vm has a type confusion (GHSA-864f-rcv7-6rh4) that lets sandboxed JavaScript reach the host process. If your Node.js agent harness runs model-generated or user-supplied code in isolated-vm, upgrade to 6.2.0 or 7.0.1 now.

isolated-vm is the Node.js library most agent harnesses and workflow automation frameworks use to execute untrusted or model-generated JavaScript in isolation. Endor Labs disclosed GHSA-864f-rcv7-6rh4 on August 19: a type confusion in ExternalCopy's transferList handling lets code inside the sandbox corrupt the host process's memory and hijack control flow — starting from nothing more than a standard ivm.Reference. Endor Labs demonstrated a full guest-to-host escape from that entry point alone.

Endor Labs reports the library receives more than 1 million weekly npm downloads; agent harnesses and workflow automation tools that execute model-generated code are in the affected set.

Patch:

• v6.x → isolated-vm@6.2.0
• v7.x → isolated-vm@7.0.1

Both shipped earlier this month. If you can't update immediately, audit what model-generated code reaches isolated-vm sandboxes in your harness and scope the blast radius.

Sandbox boundaries in agentic systems belong in your threat model — the July OpenAI/HuggingFace evaluation breach showed what happens when they aren't. Here the gap is the library itself.

Why it matters: your agent's code execution sandbox is only as strong as its version number. Patch before the next deploy.

Sources: Endor Labs disclosure — GHSA-864f-rcv7-6rh4 · The Hacker News · GitHub advisory