JavaScript Sandboxing Vulnerability in SandboxJS Library
CVE-2026-25587

10CRITICAL

Key Information:

Vendor

Nyariv

Status
Sandboxjs
Vendor
CVE Published:
6 February 2026

What is CVE-2026-25587?

A vulnerability in the SandboxJS library, prior to version 0.8.29, allows an attacker to escape the JavaScript sandbox. This occurs because the prototype of the Map class is exposed in the SAFE_PROTOTYPES, enabling potential exploitation via overwriting the Map.prototype.has method. The issue has been resolved in version 0.8.29, which reinforces the integrity of the sandbox environment.

Affected Version(s)

SandboxJS < 0.8.29

References

https://github.com/nyariv/SandboxJS/security/advisories/G...
x_refsource_CONFIRM
https://github.com/nyariv/SandboxJS/commit/67cb186c41c78c...
x_refsource_MISC

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.