JavaScript Sandboxing Flaw in SandboxJS Library by Nyariv

CVE-2026-25520

What is CVE-2026-25520?

The SandboxJS library, a JavaScript sandboxing tool, has a vulnerability in versions prior to 0.8.29 that exposes a significant security risk. This flaw occurs because the return values of functions are not properly encapsulated within the sandbox environment. By leveraging methods such as Object.values or Object.entries, an attacker can retrieve an array that includes the host's Function constructor. Using Array.prototype.at, this can lead to the execution of arbitrary code outside of the intended sandbox context. This defect has been rectified in version 0.8.29, underscoring the necessity for users to update promptly to mitigate potential security threats.

References