CVE-2026-34208
Critical · 10.0CVSS
10.0
EPSS
0.6%
Published
Apr 6, 2026
CISA due date
—
The record
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, SandboxJS blocks direct assignment to global objects (for example Math.random = ...), but this protection can be bypassed through an exposed callable constructor path: this.constructor.call(target, attackerObject). Because this.constructor resolves to the internal SandboxGlobal function and Function.prototype.call is allowed, attacker code can write arbitrary properties into host global objects and persist those mutations across sandbox instances in the same process. This vulnerability is fixed in 0.8.36.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @nyariv/sandboxjs | 0 | 0.8.36 |
Related vulnerabilities
- GHSA-2gg9-6p7w-6cpj SandboxJS: Sandbox integrity escape Same vulnerability
- CVE-2026-43898 SandboxJS is a JavaScript sandboxing library. Also affects @nyariv/sandboxjs
- GHSA-g8f2-4f4f-5jqw SandboxJS has a sandbox escape via Function.caller leakage of internal call op Also affects @nyariv/sandboxjs
- CVE-2026-34217 SandboxJS is a JavaScript sandboxing library. Also affects @nyariv/sandboxjs
- CVE-2026-34211 SandboxJS is a JavaScript sandboxing library. Also affects @nyariv/sandboxjs
- GHSA-hg73-4w7g-q96w SandboxJS: Sandbox Escape via Prop Object Leak in New Handler Also affects @nyariv/sandboxjs
- GHSA-8pfc-jjgw-6g26 SandboxJS: Stack overflow DoS via deeply nested expressions in recursive descent parser Also affects @nyariv/sandboxjs
- CVE-2026-32723 SandboxJS is a JavaScript sandboxing library. Also affects @nyariv/sandboxjs