Critical Node.js Sandbox Flaw Exposes AI Agents to Host Code Execution
ID: b7aeb54b-7c99-526d-b6d0-6598606488e8
STIX ID: report--b7aeb54b-7c99-526d-b6d0-6598606488e8
Feed Name: Cyber Press
Threat Score
A critical type-confusion flaw in isolated-vm's ExternalCopy transferList can be abused via getter/proxy behavior to substitute values between validation and use, producing attacker-influenced memory access in the host and enabling denial-of-service or potentially control-flow hijacking; fixes are available in isolated-vm 7.0.1 and 6.2.0 and organizations are urged to patch immediately, audit transitive dependencies, and limit exposed sandbox references.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.