Execution Quota Bypass in SandboxJS by Nyariv

CVE-2026-32723

What is CVE-2026-32723?

SandboxJS, a JavaScript sandboxing library, has a significant vulnerability that allows for an execution quota bypass prior to version 0.8.35. This issue arises from a shared global tick state (currentTicks.current) among multiple sandboxes. The tick state is used instead of the sandbox-specific tick object when compiling timer string handlers, which can lead to race conditions in multi-tenant environments. As a result, one sandbox may overwrite the tick state of another, allowing timer callbacks to execute under an incorrect tick budget. This vulnerability could potentially enable malicious actions that exceed the intended limits, compromising the security of the affected applications.

References