{"data":{"id":"4a5044a0-f1bf-4d81-8dc6-64c37ebfc738","title":"Critical flaw patched in popular JavaScript sandbox used in AI projects","summary":"A critical vulnerability was discovered in isolated-vm, a widely-used library that runs untrusted JavaScript code safely by isolating it in a separate process. The flaw, called a type confusion (a bug where the program treats one type of data as another type), was in the C++ binding code connecting the library to V8, the JavaScript engine, and could allow attackers to escape the sandbox and run their own code on the host system. The vulnerability affected popular AI automation projects like n8n, Sim.ai, Mastra, and Activepieces.","solution":"The isolated-vm developers patched the vulnerability in versions 7.0.1 and 6.2.0, released earlier in the month.","labels":["security"],"sourceUrl":"https://www.csoonline.com/article/4212151/critical-flaw-patched-in-popular-javascript-sandbox-used-in-ai-projects.html","publishedAt":"2026-08-20T21:00:59.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["other"],"issueType":"news","affectedPackages":null,"affectedVendors":["HuggingFace"],"affectedVendorsRaw":["n8n","Sim.ai","Mastra","Activepieces","Endor Labs"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"patchAvailable":null,"disclosureDate":"2026-08-20T21:00:59.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"advanced","impactType":["integrity","availability"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}