#toctou

The sandbox read the array twice and trusted the first answer — a getter was enough to reach the host

isolated-vm is how a lot of Node applications run untrusted JavaScript without a container. EndorLabs found its ExternalCopy path iterates a transfer list twice and trusts the earlier pass, so a JavaScript getter returning different values each time can point the native layer at attacker-chosen memory. Fixed in 6.2.0 and 7.0.1.