CVE-2026-25520: critical vulnerability in nyariv SandboxJS
SandboxJS has a Sandbox Escape
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 10epss 0.9%
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, The return values of functions aren't wrapped. Object.values/Object.entries can be used to get an Array containing the host's Function constructor, by using Array.prototype.at you can obtain the hosts Function constructor, which can be used to execute arbitrary code outside of the sandbox. This vulnerability is fixed in 0.8.29.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
nyariv · SandboxJSRelated CVEs — nyariv SandboxJS
In the same product, most dangerous first.
CVE-2026-23830CRITICALSandboxJS has Sandbox Escape via Unprotected AsyncFunction ConstructorEPSS 1.2%CVE-2026-25142CRITICALSandboxJS Prototype Pollution -> Sandbox Escape -> RCEEPSS 1.2%CVE-2026-25587CRITICALSandboxJS has a Sandbox EscapeEPSS 0.7%CVE-2026-25586CRITICALSandboxJS has a Sandbox Escape via Prototype Whitelist Bypass and Host Prototype PollutionEPSS 0.7%CVE-2026-25881CRITICAL@nyariv/sandboxjs has host prototype pollution from sandbox via array intermediary (sandbox escape)EPSS 0.6%CVE-2026-34208CRITICALSandboxJS: Sandbox integrity escapeEPSS 0.6%