A critical vulnerability has been found in the isolated-vm library of Node.js, which allows for a type confusion that can lead to remote code execution (RCE) on host systems. This vulnerability stems from the ExternalCopy function that transfers data across isolated V8 instances. By exploiting a time-of-check/time-of-use (TOCTOU) weakness, attackers can manipulate a transfer list to dereference an attacker-controlled pointer.
Successful exploitation can lead to crashes or control-flow hijacks, potentially enabling RCE. Patches were released in versions 6.2.0 and 7.0.1 to mitigate this risk. The vulnerability is significant as it affects any hosting code that shares even a single reference to untrusted code.