vulnerability
Critical Isolated-vm Vulnerability Leads to RCE on Host
Critical
Summary
A critical type confusion vulnerability in the isolated-vm Node.js library is being exploited to achieve remote code execution (RCE) on the host system. The vulnerability stems from a flawed data transfer mechanism within the library’s native glue code, allowing attackers to manipulate JavaScript objects and gain control of the host process. Patches are available in versions 6.2.0 and 7.0.1.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data