Improper access control in isolated-vm - CVE-2021-21413
Published: March 30, 2021 / Updated: November 9, 2026
Vulnerability identifier: #VU162831
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-21413
CWE-ID: CWE-284
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an attacker controlling code in an isolate to escape isolation and access the permissions of the main Node.js context.
The vulnerability exists due to unrestricted prototype-chain traversal through Reference objects in isolated-vm when an application exposes such an object to untrusted isolate code. An attacker controlling code in an isolate can traverse the exposed reference to obtain a reference to the main context's Function object.
Affected software
isolated-vm
How to mitigate CVE-2021-21413
Install security update from vendor's website.
isolated-vm - update to 4.0.0