The Sandbox Your AI Agent Runs Untrusted Code Inside Just Got a Host-RCE Escape. A Million Downloads a Week. There Is No CVE.
- Patrick Duggan
- 5 hours ago
- 5 min read
We have a standing beat here about remote code execution that arrives without a CVE number, because a bug your tooling cannot name is a bug your tooling cannot find. Twelve days ago it was TrueConf — a 9.8 unauthenticated RCE, exploited since September, whose identifiers existed only in a Russian registry your scanner does not speak. CISA gave that one CVEs on August 20, nine days after we published, which is a satisfying way to be right and also a demonstration of how long the gap stays open.
Here is the next one, and it sits underneath something a lot of people have quietly bet their architecture on.
GHSA-864f-rcv7-6rh4. A type confusion in isolated-vm that lets code running inside the sandbox corrupt host memory and, in the researchers' demonstration, hijack the host process's control flow. Every version through 7.0.0 is affected. Fixed in 6.2.0 and 7.0.1, both released earlier this month. The package pulls close to a million downloads a week, has 2,900-plus GitHub stars, and has not been assigned a CVE identifier.
What isolated-vm is, and why the number of people who depend on it is larger than the number who know they do
isolated-vm is the Node.js library you reach for when you need to run code you do not trust. It gives you a real V8 Isolate — a separate instance of the JavaScript engine with its own heap — so guest code cannot see host memory or other guests. It is the grown-up answer, the one people migrated to after vm2 spent years being escaped in public. It is a correct isolation primitive, built by a maintainer who understood the problem.
Which is exactly why it ended up as load-bearing infrastructure in the current generation of platforms: workflow automation engines that let customers write expressions, edge and serverless runtimes doing multi-tenant execution, plugin systems, low-code builders, and — the category that should make you sit up — AI agent platforms that execute model-generated code.
Think about what that last one means. The entire safety argument for letting a language model write and run code is "it runs in a sandbox." The sandbox is the argument. When the sandbox has a host escape, the argument does not degrade gracefully; it inverts. An attacker who can influence what your model generates now has a path to the host, and influencing what a model generates is the cheapest attack in the industry right now.
The bug itself, in plain terms
The flaw is a type confusion in ExternalCopy's handling of the transferList option. ExternalCopy is the machinery that serialises JavaScript values across the isolate boundary — the one component whose entire job is to be the safe door between guest and host.
It is written in C++, because it manipulates raw V8 handles, and C++ is memory-unsafe. A single unchecked cast on a re-read value was enough. Endor Labs researcher Cristian-Alexandru Staicu described the escalation directly: starting from nothing but a single ivm.Reference, they went from a controlled-address crash all the way to hijacking the host's control flow. The researchers have withheld full exploit detail.
Notice where the failure is. Not in V8's isolation — V8 did its job. Not in the JavaScript. In the native glue code at the boundary, the small amount of memory-unsafe code that every safe-language sandbox needs in order to talk to the outside world. That is a general lesson and it applies well beyond this package: the sandbox is only as strong as the serialiser at its edge, and the serialiser is almost always the one part written in the dangerous language.
Why no CVE is the operational problem, not a pedantic one
Your dependency scanner may or may not consume GitHub Security Advisories directly. Your SBOM tooling almost certainly keys on CVE. Your vulnerability management ticket workflow has a field called CVE. Your compliance evidence for a customer questionnaire says you track CVEs. Your patch SLA is written in terms of CVSS, and CVSS attaches to CVEs.
A GHSA with no CVE flows through some of that plumbing and falls out of the rest. It is not that nobody can find it — it is public, and GitHub's own Dependabot will act on it. It is that the finding does not land in the same place as everything else, so it gets triaged by a different path or by no path at all, and a month later somebody asks "were we exposed to that isolated-vm thing" and nobody can answer from the system of record.
This is the third time in five weeks we have written this same paragraph about a different product.
On July 27 it was n8n: a sandbox escape walking around a patch from February, disclosed as GHSA-gv7g-jm28-cr3m, no CVE. On August 11 it was TrueConf: BDU-only identifiers, no CVE at the time, CISA catching up nine days later. Today it is isolated-vm. And running alongside all three, MLflow's SSRF landed in CISA's KEV catalogue on August 19 — the AI control plane, actively exploited, this time with a CVE because it had already reached the point where the government had to say so out loud.
Four data points, five weeks, one shape: the infrastructure layer underneath AI systems is being found faster than it is being labelled.
What to do today
Check whether you ship it, directly or transitively. isolated-vm is frequently a transitive dependency of a platform you bought rather than a package you chose, so the lockfile is the source of truth, not your memory of what you installed. Anything at or below 7.0.0 is affected. Upgrade to 7.0.1, or 6.2.0 if you are pinned to the 6.x line.
Then ask the harder question, which is what you were trusting the sandbox to contain. If the answer is "customer-supplied expressions," you have a multi-tenant exposure. If the answer is "code our AI agent writes," you have an exposure whose trigger is prompt injection — and prompt injection is not a hypothetical this month; it is the delivery mechanism of a self-propagating Word worm that has survived two Microsoft patches and a model upgrade, which we wrote about this morning.
And treat GHSA-without-CVE as a first-class input to your vulnerability process, not an exception. Wire the advisory feed into the same queue as everything else. The gap between "publicly known" and "in your ticketing system" is where this class of bug lives, and it is entirely a plumbing problem you can fix in an afternoon.
Capped where we always cap it: there is no public evidence of exploitation in the wild as of writing, the researchers held back the working exploit, and we are not going to inflate a patchable dependency upgrade into an emergency. What makes it worth your attention is not urgency — it is who is downstream. A million weekly downloads of the component that is supposed to be the last line between untrusted code and your host, in a year when generating untrusted code became a product feature.
Sources
GHSA-864f-rcv7-6rh4, isolated-vm versions ≤7.0.0, fixed in 6.2.0 and 7.0.1. Research by Cristian-Alexandru Staicu of Endor Labs; package maintained by Marcel Laverdet. Reported by The Hacker News and SecurityWeek, 20 August 2026. Download and repository figures as published at that date.
Our own prior coverage of the same beat: n8n's patched-then-bypassed sandbox with no CVE (27 July 2026), TrueConf's BDU-only 9.8 (11 August 2026, CVEs assigned by CISA 20 August 2026), and the MLflow KEV addition (19 August 2026).
If you find isolated-vm in a lockfile you did not expect — particularly underneath a vendor platform — I would like to know which product pulled it in. That map does not exist publicly and it would be genuinely useful to build. Rate this post below.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=the-sandbox-your-ai-agent-runs-untrusted-code-inside-just-got-a-host-rce-escape-a-million-downloads
Comments