GHSA-864f-rcv7-6rh4

isolated-vm is a library for running untrusted code within a secure V8 isolate. Versions up to and including 7.0.0 are affected by a type confusion vulnerability in `ivm.ExternalCopy(value, { transferList })`. The `ExternalCopy::Copy` code path iterates over the `transfer_list` array twice without maintaining consistency between the passes: the first pass validates each element as an ArrayBuffer, while the second pass performs an unchecked cast (`As<ArrayBuffer>()`) during the transfer. Because JavaScript property accessors can return a different value on each read, an attacker can pass validation with a genuine ArrayBuffer and then return a different value (such as a small integer) during the cast pass. This type confusion leads to dereferencing an attacker-controlled address, enabling controlled read/write of host memory, control-flow hijacking, and potential remote code execution in the host process. The bug is reachable from sandboxed guest code, as any guest holding an `ivm.Refere...