CVE-2026-25520 | SandboxJS is a JavaScript sandboxing library. Prior to 0.8.2… | CVSS 10.0 CRITICAL

Description

SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, The return values of functions aren't wrapped. Object.values/Object.entries can be used to get an Array containing the host's Function constructor, by using Array.prototype.at you can obtain the hosts Function constructor, which can be used to execute arbitrary code outside of the sandbox. This vulnerability is fixed in 0.8.29.

Metadata

CVE ID: CVE-2026-25520
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-02-02 18:21 UTC
Published: 2026-02-06 19:53 UTC
Last updated: 2026-02-06 20:18 UTC
Primary CWE: CWE-74
CWE-74: Improper Neutralization of Special Elements in Outpu…
Vendor / Product: nyariv / SandboxJS
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
nyariv	SandboxJS	—	< 0.8.29

Weakness (CWE)

CWE	Source	Description
CWE-74	cna	CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References (2)

https://github.com/nyariv/SandboxJS/security/advisories/GHSA-58jh-xv4v-pcx4 https://github.com/nyariv/SandboxJS/security/advisories/GHSA-58jh-xv4v-pcx4
https://github.com/nyariv/SandboxJS/commit/67cb186c41c78c51464f70405504e8ef0a6e43c3 https://github.com/nyariv/SandboxJS/commit/67cb186c41c78c51464f70405504e8ef0a6e43c3