A double-read in isolated-vm turns customer JavaScript into host code execution

A type check that reads a value twice has not checked anything. The bindings validate what the first read returned and then operate on whatever the second read hands back, which is the part the guest controls ^[3]. Fixing that means either reading once and holding the result, or re-validating at the point of use; a patch that only tightens the check without collapsing the double read leaves the same shape available anywhere else the bindings ask a JavaScript object a question twice.

The entry condition is worth sitting with. The guest needs untrusted execution inside the isolate plus at least one `ivm.Reference` passed in from the host ^[4]. That reference is the bridge, and the advisory's own fallback for anyone who cannot upgrade is to stop passing references to untrusted code or to turn the feature off entirely ^[9]. Read those two together and the sandbox stops looking like a wall with a door in it.

The version guidance does not close cleanly. The affected set is given as 7.0.0 or lower, or 6.x below 6.2.0 ^[5], while the fixed versions are 7.0.1 and 6.2.0 ^[6]. Taken literally, "7.0.0 or lower" contains 6.2.0, which the same document lists as the remedy ^[19]. Anyone pinned on the 6.x line cannot resolve their status from that sentence and has to go to the advisory record itself.

Forensics are thin by design. The basic proof of concept ends in `SIGSEGV` and exit 139 ^[7], with crash sites near `v8::ArrayBuffer::IsDetachable` ^[8]. The advanced path does not end in a crash; it ends with guest processing in control of the host process ^[10]. The write-up also notes that the sequence begins inside guest processing with no network signs, and that any outbound traffic afterwards depends entirely on the payload, with nothing published ^[11]. So the loud artifact belongs to the attempt that failed, and the quiet one is the case you care about.

On the strength of the evidence: the record reports no observed exploitation in public information, and only proof-of-concept-style `transferList` and getter inputs confirmed internally ^[12]. It also carries a severity of high ^[13] while the Endor Labs write-up it points to, dated 20 August 2026, is titled as critical ^[14], and lists the GHSA identifier with no CVE attached ^[15]. Investigation guidance names audits of code execution nodes and workers in tools like n8n, worker environment variables, cloud credentials and connection destinations ^[18]. That is where the value sits, and it always did. What changed is the confidence you can place in the isolate that was drawn between it and the customer's expression field ^[1].