Critical Sandbox Escape Vulnerability (GHSA‑864f‑rcv7‑6rh4) in Isolated‑VM Library Threatens Host RCE
What Happened — Researchers disclosed a critical flaw in isolated‑vm, an open‑source Node.js sandbox used to run untrusted JavaScript. The vulnerability (GHSA‑864f‑rcv7‑6rh4) allows code inside the sandbox to break out and execute commands on the host system, effectively enabling remote code execution. All library versions up to 7.0.0 are affected.
Why It Matters for Compliance & Audit Readiness
- The flaw exemplifies a control‑gap where a third‑party component defeats the “environment isolation” control required by SOC 2 CC6.1 (System Operations) and CC7.1 (Change Management).
- Continuous evidence that only vetted, patched libraries are in production is essential to demonstrate due diligence during a SOC 2 audit.
- Verisq’s Control Mapping capability can automatically map library versions to required SOC 2 controls and provide real‑time evidence of remediation.
Who Is Affected — SaaS providers, cloud‑native platforms, and any organization embedding isolated‑vm in its application stack (technology, fintech, health‑tech, etc.).
Recommended Actions
- Inventory all assets that depend on isolated‑vm and verify the version in use.
- Upgrade to a patched release (≥ 7.0.1) or apply vendor‑provided mitigations.
- Map the library’s version to SOC 2 CC6.1/CC7.1 controls, capture upgrade evidence, and update your change‑management logs.
- Incorporate automated dependency scanning into your continuous‑compliance pipeline.
Source: The Hacker News
Technical Notes
- Vulnerability ID: GHSA‑864f‑rcv7‑6rh4 (no CVE assigned yet).
- Impact: Sandbox escape → host‑level code execution.
- Attack vector: Exploitation of a library‑level flaw (VULNERABILITY_EXPLOIT).
- No public exploits reported at time of disclosure.