CVE-2026-25142criticalCWE-94

CVE-2026-25142: fallo crítico en nyariv SandboxJS

SandboxJS Prototype Pollution -> Sandbox Escape -> RCE

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear SandboxJS+ Monitorear @nyariv/sandboxjs

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 10epss 1.2%
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.27, SanboxJS does not properly restrict __lookupGetter__ which can be used to obtain prototypes, which can be used for escaping the sandbox / remote code execution. This vulnerability is fixed in 0.8.27.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Productos afectados
nyariv · SandboxJS
CVEs relacionadas — nyariv SandboxJS

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-23830CRITICALSandboxJS has Sandbox Escape via Unprotected AsyncFunction ConstructorEPSS 1.2%CVE-2026-25520CRITICALSandboxJS has a Sandbox EscapeEPSS 0.9%CVE-2026-25587CRITICALSandboxJS has a Sandbox EscapeEPSS 0.7%CVE-2026-25586CRITICALSandboxJS has a Sandbox Escape via Prototype Whitelist Bypass and Host Prototype PollutionEPSS 0.7%CVE-2026-25881CRITICAL@nyariv/sandboxjs has host prototype pollution from sandbox via array intermediary (sandbox escape)EPSS 0.6%CVE-2026-34208CRITICALSandboxJS: Sandbox integrity escapeEPSS 0.6%