CVE-2026-25587criticalCWE-94

CVE-2026-25587: falha crítica em nyariv SandboxJS

SandboxJS has a Sandbox Escape

Publicada em

Seguir esta CVE+ Monitorar SandboxJS+ Monitorar @nyariv/sandboxjs

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 10epss 0.7%
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, as Map is in SAFE_PROTOYPES, it's prototype can be obtained via Map.prototype. By overwriting Map.prototype.has the sandbox can be escaped. This vulnerability is fixed in 0.8.29.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
nyariv · SandboxJS
CVEs relacionadas — nyariv SandboxJS

No mesmo produto, das mais perigosas para as menos.

CVE-2026-23830CRITICALSandboxJS has Sandbox Escape via Unprotected AsyncFunction ConstructorEPSS 1.2%CVE-2026-25142CRITICALSandboxJS Prototype Pollution -> Sandbox Escape -> RCEEPSS 1.2%CVE-2026-25520CRITICALSandboxJS has a Sandbox EscapeEPSS 0.9%CVE-2026-25586CRITICALSandboxJS has a Sandbox Escape via Prototype Whitelist Bypass and Host Prototype PollutionEPSS 0.7%CVE-2026-25881CRITICAL@nyariv/sandboxjs has host prototype pollution from sandbox via array intermediary (sandbox escape)EPSS 0.6%CVE-2026-34208CRITICALSandboxJS: Sandbox integrity escapeEPSS 0.6%