{"id":"CVE-2021-21413","aliases":["GHSA-mmhj-4w6j-76h7"],"url":"https://o3.security/vulnerability/CVE-2021-21413","summary":"Misuse of `Reference` and other transferable APIs may lead to access to nodejs isolate","details":"Versions of `isolated-vm` before v4.0.0, and especially before v3.0.0, have API pitfalls which may make it easy for implementers to expose supposed secure isolates to the permissions of the main nodejs isolate.\n\n`Reference` objects allow access to the underlying reference's full prototype chain. In an environment where the implementer has exposed a `Reference` instance to an attacker they would be able to use it to acquire a `Reference` to the nodejs context's `Function` object.\n\nSimilar application-specific attacks could be possible by modifying the local prototype of other API objects.\n\nAccess to `NativeModule` objects could allow an attacker to load and run native code from anywhere on the filesystem. If combined with, for example, a file upload API this would allow for arbitrary code execution.\n\nTo address these issues the following changes were made in v4.0.0:\n- Documentation was updated with more explicit guidelines on building secure applications.\n- `Reference` instances will no longer follow prototype chains by default, nor will they invoke accessors or proxies.\n- All `isolated-vm` API prototypes are now immutable.\n- `NativeModule` constructor may only be invoked from a nodejs isolate.","published":"2021-03-30T23:15:14.190Z","modified":"2026-09-22T08:18:20.215518Z","cvss":{"score":9.6,"severity":"CRITICAL","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"isolated-vm","fixedVersion":"4.0.0"}],"fix":{"url":"https://github.com/laverdet/isolated-vm/commit/2646e6c1558bac66285daeab54c7d490ed332b15","label":"laverdet/isolated-vm@2646e6c"},"references":[{"type":"ADVISORY","url":"https://github.com/laverdet/isolated-vm/blob/main/CHANGELOG.md#v400"},{"type":"ADVISORY","url":"https://github.com/laverdet/isolated-vm/security/advisories/GHSA-mmhj-4w6j-76h7"},{"type":"FIX","url":"https://github.com/laverdet/isolated-vm/commit/2646e6c1558bac66285daeab54c7d490ed332b15"},{"type":"FIX","url":"https://github.com/laverdet/isolated-vm/commit/27151bfecc260e96714443613880e3b2e6596704"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21413"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-22T08:18:20.215518Z"}}