exploit 2026-08-20

Critical sandbox escape vulnerability in isolated-vm

A critical sandbox escape vulnerability was discovered in isolated-vm, a library for running JavaScript code inside an isolated process, in isolated-vm version 1.2.0. The vulnerability, identified as CVE-2023-2751, could allow attackers to hijack the host's control flow, which could enable remote co

Bottom line: Security teams must patch isolated-vm to prevent potential hijacking of host control flow and remote code execution.

What's happening: Researchers at Qualys discovered the vulnerability, which was publicly disclosed on June 15, 2023, and patched in isolated-vm version 1.3.0.

What to do: Security teams should immediately update isolated-vm to version 1.3.0 and monitor for suspicious activity.

Source: CSO Online