Sandbox Escape Vulnerability in SandboxJS Library by Nyariv
CVE-2026-25881

9.1CRITICAL

Key Information:

Vendor

Nyariv

Status
Sandboxjs
Vendor
CVE Published:
9 February 2026

What is CVE-2026-25881?

The SandboxJS library, which enables JavaScript sandboxing, contains a vulnerability that permits sandboxed code to escape its confines and modify host built-in prototypes. Specifically, prior to version 0.8.31, an attacker could exploit this flaw by passing a global prototype reference through an array, bypassing the isGlobal protection flag. This manipulation leads to persistent prototype pollution, increasing the risk of remote code execution (RCE) in applications that leverage these altered properties. This issue has been addressed in version 0.8.31.

Affected Version(s)

SandboxJS < 0.8.31

References

https://github.com/nyariv/SandboxJS/security/advisories/G...
x_refsource_CONFIRM
https://github.com/nyariv/SandboxJS/commit/f369f8db26649f...
x_refsource_MISC

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.