CVE-2026-43898

Published: May 28, 2026Modified: Jun 17, 2026

10.0

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 6.0

Source: security-advisories@github.com (Secondary)

Description

SandboxJS is a JavaScript sandboxing library. Prior to 0.9.6, sandbox-defined functions expose Function.caller, allowing sandboxed code to recover the internal LispType.Call runtime callback. That callback can then be invoked with attacker-controlled fake context and obj values to extract blocked host statics, recover the real host Function constructor, and execute arbitrary host JavaScript. This vulnerability is fixed in 0.9.6.

Affected (1)

Products: Nyariv: Sandboxjs

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Nyariv Sandboxjs	Before 0.9.6

Related CWEs

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (3)

https://github.com/nyariv/SandboxJS/commit/826865251232611ec94078bab5a18ec875dad4a5

Source: security-advisories@github.com

Patch

https://github.com/nyariv/SandboxJS/security/advisories/GHSA-g8f2-4f4f-5jqw

Source: security-advisories@github.com

ExploitVendor Advisory

https://github.com/nyariv/SandboxJS/security/advisories/GHSA-g8f2-4f4f-5jqw

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitVendor Advisory

Timeline

No history available yet.