JavaScript Sandbox Escape in SandboxJS Library by Nyariv

CVE-2026-23830

What is CVE-2026-23830?

The SandboxJS library, which provides a JavaScript sandboxing solution, contains a vulnerability that allows attackers to escape its sandbox environment. This issue arises in versions prior to 0.8.26 due to the lack of isolation of AsyncFunction within the SandboxFunction. The non-inclusion of mappings for AsyncFunction, GeneratorFunction, and AsyncGeneratorFunction in previous versions enables attackers to access the native AsyncFunction constructor. If an attacker creates an async function inside the sandbox, they can exploit this flaw to execute code outside the sandbox, thereby gaining unrestricted access to the host environment. Version 0.8.26 rectifies this significant security concern.

References