CVE-2026-26954
Critical · 10.0CVSS
10.0
EPSS
0.6%
Published
Mar 13, 2026
CISA due date
—
The record
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.34, it is possible to obtain arrays containing Function, which allows escaping the sandbox. Given an array containing Function, and Object.fromEntries, it is possible to construct {[p]: Function} where p is any constructible property. This vulnerability is fixed in 0.8.34.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @nyariv/sandboxjs | 0 | 0.8.34 |
Related vulnerabilities
- GHSA-6r9f-759j-hjgv SandboxJS affected by a Sandbox Escape Same vulnerability
- CVE-2026-43898 SandboxJS is a JavaScript sandboxing library. Also affects @nyariv/sandboxjs
- GHSA-g8f2-4f4f-5jqw SandboxJS has a sandbox escape via Function.caller leakage of internal call op Also affects @nyariv/sandboxjs
- CVE-2026-34208 SandboxJS is a JavaScript sandboxing library. Also affects @nyariv/sandboxjs
- CVE-2026-34217 SandboxJS is a JavaScript sandboxing library. Also affects @nyariv/sandboxjs
- CVE-2026-34211 SandboxJS is a JavaScript sandboxing library. Also affects @nyariv/sandboxjs
- GHSA-hg73-4w7g-q96w SandboxJS: Sandbox Escape via Prop Object Leak in New Handler Also affects @nyariv/sandboxjs
- GHSA-8pfc-jjgw-6g26 SandboxJS: Stack overflow DoS via deeply nested expressions in recursive descent parser Also affects @nyariv/sandboxjs