Isolated-vm Flaw Lets Sandboxed JavaScript Escape to Host for Potential RCE

Security researchers disclosed a critical type-confusion vulnerability in the isolated-vm Node.js sandbox library that allows code running inside a guest V8 isolate to corrupt host memory and potentially hijack host control flow, effectively enabling a sandbox escape and possible remote code execution. The flaw affects versions up to 7.0.0, has been patched in 6.2.0 and 7.0.1, and maintainers recommend updating; no active exploitation in the wild is reported in the document.