CVE-2026-25520

Published: Feb 6, 2026Modified: Jun 17, 2026

10.0

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 6.0

Source: security-advisories@github.com (Secondary)

Description

SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, The return values of functions aren't wrapped. Object.values/Object.entries can be used to get an Array containing the host's Function constructor, by using Array.prototype.at you can obtain the hosts Function constructor, which can be used to execute arbitrary code outside of the sandbox. This vulnerability is fixed in 0.8.29.

Affected (1)

Products: Nyariv: Sandboxjs

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Nyariv Sandboxjs	Before 0.8.29

Related CWEs

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

References (3)

https://github.com/nyariv/SandboxJS/commit/67cb186c41c78c51464f70405504e8ef0a6e43c3

Source: security-advisories@github.com

Patch

https://github.com/nyariv/SandboxJS/security/advisories/GHSA-58jh-xv4v-pcx4

Source: security-advisories@github.com

ExploitVendor Advisory

https://github.com/nyariv/SandboxJS/security/advisories/GHSA-58jh-xv4v-pcx4

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitVendor Advisory

Timeline

No history available yet.