CVE-2026-5752

Critical · 9.3

CVSS

9.3

EPSS

0.2%

Published

Apr 14, 2026

CISA due date

—

The record

Sandbox Escape Vulnerability in Terrarium allows arbitrary code execution with root privileges on a host process via JavaScript prototype chain traversal.

Affected packages

Ecosystem	Package	Introduced	Fixed