CVE-2026-34217
High · 7.2CVSS
7.2
EPSS
0.3%
Published
Apr 6, 2026
CISA due date
—
The record
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, a scope modification vulnerability exists in @nyariv/sandboxjs. The vulnerability allows untrusted sandboxed code to leak internal interpreter objects through the new operator, exposing sandbox scope objects in the scope hierarchy to untrusted code; an unexpected and undesired exploit. While this could allow modifying scopes inside the sandbox, code evaluation remains sandboxed and prototypes remain protected throughout the execution. This vulnerability is fixed in 0.8.36.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @nyariv/sandboxjs | 0 | 0.8.36 |
Related vulnerabilities
- GHSA-hg73-4w7g-q96w SandboxJS: Sandbox Escape via Prop Object Leak in New Handler Same vulnerability
- CVE-2026-43898 SandboxJS is a JavaScript sandboxing library. Also affects @nyariv/sandboxjs
- GHSA-g8f2-4f4f-5jqw SandboxJS has a sandbox escape via Function.caller leakage of internal call op Also affects @nyariv/sandboxjs
- CVE-2026-34208 SandboxJS is a JavaScript sandboxing library. Also affects @nyariv/sandboxjs
- CVE-2026-34211 SandboxJS is a JavaScript sandboxing library. Also affects @nyariv/sandboxjs
- GHSA-8pfc-jjgw-6g26 SandboxJS: Stack overflow DoS via deeply nested expressions in recursive descent parser Also affects @nyariv/sandboxjs
- GHSA-2gg9-6p7w-6cpj SandboxJS: Sandbox integrity escape Also affects @nyariv/sandboxjs
- CVE-2026-32723 SandboxJS is a JavaScript sandboxing library. Also affects @nyariv/sandboxjs