n8n

isolated-vm sandbox escape (GHSA-864f-rcv7-6rh4): a TOCTOU type-confusion in ExternalCopy's transferList marshaling breaks the V8 Isolate guest/host boundary, the sandbox underneath a wide range of AI-agent and low-code automation platforms

isolated-vm gives each untrusted-JavaScript sandbox its own V8 Isolate, a separate heap with no shared object graph with the host, the same primitive Chrome uses to separate tabs. Endor Labs (credited discoverer, no CVE assigned as of this run) found that the isolation primitive itself held; what broke is the C++ marshaling code that copies values across the boundary: "we did not break the V8 Isolate. We broke the code that carries data into it" (Endor Labs, 2026-08-20).

ExternalCopy's transferList option (a postMessage-style zero-copy ArrayBuffer transfer) walks the transfer-list array twice in src/external_copy/serializer.cc: the first walk validates each element with IsArrayBuffer() and registers it; the second performs an unchecked handle.As<ArrayBuffer>() reinterpret-cast with no re-validation. Because transfer_list is a real JavaScript array and both walks read it via a genuine property access that invokes JS accessors, a guest can define transferList[0] as a getter that returns a real ArrayBuffer on the first read (satisfying walk 1's check) and an attacker-chosen value on the second read; the unchecked cast then treats that value as an ArrayBuffer, yielding a controlled-address read/write primitive: "As <ArrayBuffer>() is not a checked conversion. It is a bare reinterpret-cast that tells V8, 'trust me, this is an ArrayBuffer.' The code assumes it is safe because walk 1 already checked, but that assumption only holds if the two walks see the same values" (Endor Labs, 2026-08-20). Endor Labs escalated this from a single ivm.Reference (the minimum capability any embedder must hand a sandbox for it to do anything at all) to full host control-flow hijacking, demonstrating a complete guest-to-host escape.

Fixed in 7.0.1 (mainline) and 6.2.0 (6.x backport), both released 2026-08-08, by wrapping ExternalCopy::Copy in a v8::Isolate::DisallowJavascriptExecutionScope that prevents any guest JS (getters, proxies, interceptors) from running during the copy, closing the time-of-check-to-time-of-use window outright: "the maintainer responded quickly and shipped a fix in versions 7.0.1 and 6.2.0. The patch wraps ExternalCopy::Copy in a v8::Isolate::DisallowJavascriptExecutionScope, which prevents any user JavaScript (getters, proxies, interceptors) from running during the copy" (Endor Labs, 2026-08-20).

isolated-vm (1M+ weekly downloads) is the sandbox of record for a wide range of AI-agent and automation platforms that execute model- or user-generated code: Endor Labs names n8n (which recommends isolated-vm for its Code-node task runners), Activepieces, Mastra AI (its "code mode" tool-orchestration execution), Budibase (which migrated off the deprecated vm2), Sim.ai, Directus and Rocket.Chat as production consumers whose guest/host boundary is this exact library. The absence of a CVE identifier does not soften the exposure: an anonymous, single-call escape from the isolation primitive that a widely-deployed class of self-hosted automation platforms advertises as its safety boundary is the class of flaw that demands action ahead of a routine patch cycle regardless of a formal severity score.

Triage: any self-hosted platform advertising sandboxed code execution via isolated-vm should confirm its patched version directly; a version check against the platform's own release notes rather than against isolated-vm's version alone, since embedders bundle it at different cadences. There is no telemetry-side discriminator for this flaw once patched; the mitigation is entirely upgrade-based, since the vulnerable code path executes inside the sandbox implementation itself rather than producing an externally observable behavioral signature before the escape completes.

Unit 42 recovers a live autonomous-AI attack operation after it exposed its own home directory, the confirmed compromises came from manual exploitation of Citrix NetScaler (CVE-2026-3055) and Marimo notebooks, not the agent

Palo Alto Unit 42 published an unusually complete reconstruction of a live offensive operation on 2026-07-30, made possible by the operator's own mistake: its agent framework, acting on a command sent over Telegram, started an HTTP file server from the operator's home directory rather than an isolated staging path, exposing AI tool configurations, API keys, exploit scripts, target lists, shell history and the agent's own session logs (Unit 42, 2026-07-30). Unit 42 notes this was out of character; the same operator had emptied exploit directories after use and disabled conversation logging in one of its tools.

The operator, who uses the handles knaithe and KnYuan and describes themselves as a Zhuhai-based binary-security researcher, ran DeepSeek as the reasoning engine behind the open-source Hermes Agent, extended with three capabilities: a framework-bundled jailbreak skill, a custom module for attacking unauthenticated WebSocket endpoints, and a custom procedure that drives internet-wide asset enumeration through a scanning service, wired to a natural-language-to-search-query translator exposed to the agent as a tool.

The result is the part worth reading carefully. Every compromise Unit 42 confirms came from the operator's manual work: data exfiltration from three Citrix NetScaler targets and command execution on 11 Marimo notebook endpoints. Both fully autonomous exploitation attempts failed. Against Langflow, the agent needed either a login-bypass setting enabled or a public flow identifier and found neither; against n8n (which its scanning put at 647,017 instances globally and 25,209 in China) it worked the Chinese slice, sampled about a hundred, probed roughly forty, found three candidates, and was stopped because the unauthenticated form endpoint the exploit chain required was behind authentication on every one. Unit 42's own reading is that the failures were target-side configuration, not defensive detection, and that targets with weaker defaults would have been compromised, a hardening finding rather than a ceiling on the capability. The agent's decision-making is visible in the recovered logs: it abandoned the Langflow target set after assessing the deployment population as too small to be worth the effort and pivoted to a more widely deployed product on its own.

What actually worked was hand-driven. Using CVE-2026-3055, an out-of-bounds memory read in Citrix NetScaler ADC and Gateway, the operator exfiltrated appliance memory from three organisations and searched the recovered bytes for NetScaler authentication cookies, which Unit 42 reads as session-hijacking intent. It describes persistent multi-day targeting of a Malaysian government entity using memory-grooming parameters and maximum read attempts, with the operator returning behind proxy anonymisation on later attempts, behaviour it contrasts with the autonomous campaigns, which hit Chinese domestic infrastructure indiscriminately. Other manual activity included command execution against Marimo notebook instances, deserialization reverse-shell attempts against Tomcat servers and callbacks against Windows IKE VPN endpoints; a cloned PAN-OS exploit was non-functional, carrying placeholder values that cannot achieve code execution, with no evidence of modification or execution found.

The CVE itself deserves separate attention from the AI story, because it is the element with direct constituency exposure. It affects NetScaler ADC and Gateway only when the appliance is configured as a SAML Identity Provider; a precondition Unit 42 does not mention and which comes from the vulnerability record and the vendor's bulletin (Citrix, 2026-03-23). It is KEV-listed, and watchTowr's honeypot network observed exploitation from known threat-actor addresses as of 2026-03-27, months before and unrelated to this operator (watchTowr Labs, 2026-03-29). watchTowr also documents a second overread path under the same CVE reachable through a different endpoint, so an operator validating exposure should not assume a single request signature covers it.

Unit 42 also reports that the operator routed two Western tools, Claude Code and Codex, through a third-party proxy with attribution headers disabled and response storage turned off. It says Claude Code was used only for connectivity testing and proxy validation, its session history holding model checks, connectivity tests and one package-install request across three sessions, and that there were signs of Codex use in exploit-development directories though those chat logs were not preserved, and it relays OpenAI's confirmation that its provider-side safeguards refused the policy-violating requests and that its safety systems flagged and disabled the linked account before Unit 42 shared intelligence. Unit 42's inference is that the operator chose the model with the fewest controls for the autonomous engine precisely because provider-side controls limited the alternatives.

Detection. For the NetScaler exposure the observable is in the appliance's own web logs: repeated requests to the SAML identity-provider endpoints from a single source, returning responses whose length varies request to request, with no corresponding completed authentication; memory-overread harvesting looks like a failing login loop that never fails cleanly. Follow it with authentication telemetry: a session cookie presented from an address or client fingerprint that never performed the sign-in that minted it is the downstream consequence the operator was working toward. More broadly, the enumeration behaviour Unit 42 describes leaves an approach signature worth hunting on any exposed application, high-volume version-fingerprinting requests from a narrow address set, followed within a short window by a small number of precisely-targeted exploit attempts against just the instances whose version replied in scope.

Triage: scanning noise against edge appliances is constant, so volume alone discriminates nothing. Two things separate this from background scanning: the requests target the specific identity-provider paths rather than sweeping the whole surface, and successful reads produce responses that are neither errors nor valid authentication outcomes. On the enumeration side, ordinary vulnerability scanners announce themselves through breadth and user-agent consistency; what Unit 42 describes is narrow, sequenced and selective, a fingerprint pass followed by exploitation of only the matching subset.

Wiz Cloud Threat Highlights H1 2026: LiteLLM had four separate security events in six months, unauthenticated MCP endpoints turned up across hundreds of environments, and a new extortion actor goes after service accounts rather than people

Wiz Research's semi-annual cloud threat report covers January to June 2026, and its value for this constituency is the named inventory rather than the trend lines: it says concretely which AI infrastructure attracted attacker and researcher attention, and what the resulting exposure looks like in a cloud estate.

The AI toolchain now has its own vulnerability cadence. LiteLLM (an AI gateway Wiz says is present in over a third of the cloud environments it monitors) "had four separate security events in six months: a supply-chain compromise, an SQL injection vulnerability exploited in the wild, a privilege escalation chain and an authentication bypass", while Dify, Langflow, n8n and Ollama "each had critical unauthenticated vulnerabilities of their own" (Wiz Research, 2026-08-06). That list is worth reading as an asset-inventory prompt: these are components teams stand up quickly, often outside the change process that governs the rest of the estate, and three of the five have already reached this pipeline's coverage through separate exploited-vulnerability events.

The exposure finding is sharper than the vulnerability one. On Model Context Protocol servers, Wiz reports: "We found unauthenticated MCP endpoints across hundreds of environments, each one a pre-authenticated proxy holding backend credentials and bridging multiple services" (Wiz Research, 2026-08-06). The reason that shape matters is that an MCP server is not a data store to be broken into; it is a component that already holds the credentials for everything behind it and exists to act on their behalf, so reaching it unauthenticated is not a step toward access, it is the access.

On the actor side, Wiz profiles JINX-0163, a cloud-native extortion group it began tracking in 2026 and that "consistently targets non-human identities - service accounts and IAM roles - rather than end users", in some cases leveraging a single over-privileged identity or an exposed state file to pivot to a full inventory (Wiz Research, 2026-08-06). An extortion group that skips human identity entirely bypasses most of the control stack organisations have spent two years building (phishing-resistant MFA, conditional access, helpdesk verification) none of which applies to a service account.

On supply chain, Wiz records that notable supply-chain attacks "went from making up about 10% of significant incidents in H2 2025 to 25% in H1 2026", with TeamPCP, North Korea and at least three independent operations running campaigns concurrently across npm, PyPI, Composer, VSCode extensions, Jenkins plugins and AUR, several of which had not been targeted this way before (Wiz Research, 2026-08-06). It also notes that malicious packages' shrinking availability window is what makes an install cooldown policy effective (declining to download packages published less than 24 hours ago) which is a specific, cheap control rather than a general recommendation.