Critical Type Confusion Vulnerability Discovered in isolated-vm Library

A critical vulnerability (GHSA-864f-rcv7-6rh4) was discovered in the isolated-vm library, which is widely used in AI projects and has over 1 million weekly downloads. This type confusion flaw allows attackers to hijack the host's control flow, potentially leading to remote code execution. The vulnerability exists in the C++ code that manages data transfer into V8's Isolate, not in the isolation mechanism itself. Endor Labs, which identified the flaw, emphasized that the isolation boundary remains intact. The isolated-vm developers have released patches in versions 7.0.1 and 6.2.0 to address this issue. The security advisory detailing the flaw was made public on August 20, 2026.

Key Points: • A critical type confusion vulnerability was found in the isolated-vm library. • The flaw could allow attackers to hijack control flow, leading to remote code execution. • Patches have been released in versions 7.0.1 and 6.2.0 to mitigate the vulnerability.