CVE-2026-25641: critical vulnerability in nyariv SandboxJS
SandboxJS has a sandbox escape via TOCTOU bug on keys in property accesses
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 10epss 0.5%
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, there is a sandbox escape vulnerability due to a mismatch between the key on which the validation is performed and the key used for accessing properties. Even though the key used in property accesses is annotated as string, this is never enforced. So, attackers can pass malicious objects that coerce to different string values when used, e.g., one for the time the key is sanitized using hasOwnProperty(key) and a different one for when the key is used for the actual property access. This vulnerability is fixed in 0.8.29.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
nyariv · SandboxJSRelated CVEs — nyariv SandboxJS
In the same product, most dangerous first.
CVE-2026-23830CRITICALSandboxJS has Sandbox Escape via Unprotected AsyncFunction ConstructorEPSS 1.2%CVE-2026-25142CRITICALSandboxJS Prototype Pollution -> Sandbox Escape -> RCEEPSS 1.2%CVE-2026-25520CRITICALSandboxJS has a Sandbox EscapeEPSS 0.9%CVE-2026-25587CRITICALSandboxJS has a Sandbox EscapeEPSS 0.7%CVE-2026-25586CRITICALSandboxJS has a Sandbox Escape via Prototype Whitelist Bypass and Host Prototype PollutionEPSS 0.7%CVE-2026-25881CRITICAL@nyariv/sandboxjs has host prototype pollution from sandbox via array intermediary (sandbox escape)EPSS 0.6%