Prototype Pollution Vulnerability in @nyariv/sandboxjs
CVE-2025-34146

7HIGH

Key Information:

Vendor

Nyariv

Status
Sandboxjs
Vendor
CVE Published:
31 July 2025

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2025-34146?

A prototype pollution vulnerability in @nyariv/sandboxjs enables attackers to inject arbitrary properties into Object.prototype through specially crafted JavaScript code. This flaw can lead to a denial-of-service (DoS) situation or, in specific circumstances, allow the escape from the sandboxed environment that is designed to restrict code execution. The root cause of this issue lies in inadequate prototype access validation within the sandbox’s executor logic, especially when processing JavaScript function objects.

Affected Version(s)

sandboxjs * <= 0.8.23

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-34146 - Proof of Concept

References

https://gist.github.com/Hagrid29/9df27829a491080f923c4f6b...
issue-trackingexploit
https://github.com/nyariv/SandboxJS/issues/31
patchvendor-advisory
https://www.npmjs.com/package/@nyariv/sandboxjs
product

CVSS V4

Score:
7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Hagrid29
.
CVE-2025-34146 : Prototype Pollution Vulnerability in @nyariv/sandboxjs