CVE-2021-21413: 
JavaScript vulnerability analysis and mitigation

CVE-2021-21413 is a high-severity vulnerability affecting versions of isolated-vm before v4.0.0. The vulnerability was discovered and disclosed on March 30, 2021. The affected software component is the isolated-vm package, which is used for running code in V8 isolates in Node.js applications (GitHub Advisory).

The vulnerability stems from API pitfalls in isolated-vm that could allow attackers to gain access to the main Node.js isolate's permissions through misuse of Reference objects. The key technical issue is that Reference objects allowed access to the underlying reference's full prototype chain, which could be exploited to acquire a Reference to the Node.js context's Function object. Additionally, access to NativeModule objects could enable loading and executing native code from anywhere on the filesystem (GitHub Advisory).

If successfully exploited, this vulnerability could allow attackers to bypass security isolates and gain the permissions of the main Node.js isolate. When combined with other features like file upload APIs, this could lead to arbitrary code execution. The vulnerability is particularly severe in environments where Reference instances are exposed to potential attackers (GitHub Advisory).

The vulnerability can be exploited through application-specific attacks by modifying the local prototype of API objects. If an implementer has exposed a Reference instance to an attacker, they could leverage this vulnerability to gain unauthorized access to the Node.js context (GitHub Advisory).

The vulnerability was patched in version 4.0.0 of isolated-vm with several security improvements: Reference instances no longer follow prototype chains by default and won't invoke accessors or proxies, all isolated-vm API prototypes are now immutable, and the NativeModule constructor can only be invoked from a Node.js isolate. Users should upgrade to version 4.0.0 or later to address this vulnerability (GitHub Advisory).