JavaScript Sandboxing Vulnerability in SandboxJS Library
CVE-2026-25586

10CRITICAL

Key Information:

Vendor

Nyariv

Status
Sandboxjs
Vendor
CVE Published:
6 February 2026

What is CVE-2026-25586?

The SandboxJS library, utilized for JavaScript sandboxing, exhibits a significant vulnerability in versions prior to 0.8.29. By exploiting this flaw, specifically through shadowing the hasOwnProperty method on a sandbox object, attackers can compromise the prototype whitelist enforcement mechanism. This breach allows them to access restricted properties such as proto and others, leading to potential Object.prototype pollution. Consequently, this vulnerability can create enduring impacts across multiple sandboxes, amplifying the urgency for an immediate software update to version 0.8.29 or later to mitigate associated risks. For detailed information, refer to the official advisories.

Affected Version(s)

SandboxJS < 0.8.29

References

https://github.com/nyariv/SandboxJS/security/advisories/G...
x_refsource_CONFIRM
https://github.com/nyariv/SandboxJS/commit/67cb186c41c78c...
x_refsource_MISC

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.