The isolated-vm Node.js library provides isolated V8 JavaScript engine instances (Isolates) for sandboxed code execution. A type confusion bug in the ExternalCopy constructor, which serializes and transfers data between Isolates, arises from iterating a transferList JavaScript array twice, where the second iteration trusts the first. Because the array elements are getters returning different values on each iteration, this creates a TOCTOU vulnerability allowing dereferencing of attacker-controlled pointers. Although ExternalCopy is host-accessible only, a guest can manipulate ivm.Reference to craft a malicious transferList and trigger the bug. Exploitation can crash the host process or hijack its control flow, enabling remote code execution. The vulnerability stems from unsafe native C++ glue code handling raw V8 handles and backing-store pointers. Official patches in versions 6.2.0 and 7.0.1 prevent user JavaScript execution during copying, mitigating the issue.

Exploitation of this vulnerability can lead to denial-of-service via host process crashes or full remote code execution on the host system. This compromises the isolation guarantees of the V8 sandbox, allowing attackers to escape the sandbox and execute arbitrary code with host privileges.

Patches are available and should be applied by upgrading isolated-vm to version 6.2.0 or later, or 7.0.1 or later. These updates prevent user JavaScript from running during the copy operation, mitigating the vulnerability. Users running untrusted code in an isolate and sharing any Reference into it are affected and should update promptly.