Scope Modification Vulnerability in SandboxJS by Nyariv
CVE-2026-34217

6.9MEDIUM

Key Information:

Vendor

Nyariv

Status
Sandboxjs
Vendor
CVE Published:
6 April 2026

What is CVE-2026-34217?

A scope modification vulnerability in the JavaScript sandboxing library SandboxJS allows untrusted code to leak internal interpreter objects. This occurs through the use of the 'new' operator, which can expose sandbox scope objects to untrusted code in violation of intended isolation measures. While the execution within the sandbox remains constrained, and prototypes are protected, this vulnerability can still permit scope modifications that could lead to unexpected behavior. The issue has been addressed in version 0.8.36.

Affected Version(s)

SandboxJS < 0.8.36

References

https://github.com/nyariv/SandboxJS/security/advisories/G...
x_refsource_CONFIRM

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.