Back to overview

CVE-2026-25641

CRITICAL Exploitation: PoC
10.0
CVSS 3.1
Description
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, there is a sandbox escape vulnerability due to a mismatch between the key on which the validation is performed and the key used for accessing properties. Even though the key used in property accesses is annotated as string, this is never enforced. So, attackers can pass malicious objects that coerce to different string values when used, e.g., one for the time the key is sanitized using hasOwnProperty(key) and a different one for when the key is used for the actual property access. This vulnerability is fixed in 0.8.29.

Metadata

CVE ID
CVE-2026-25641
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-02-04 05:15 UTC
Published
2026-02-06 19:50 UTC
Last updated
2026-02-06 20:20 UTC
Primary CWE
CWE-367
CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
Vendor / Product
nyariv / SandboxJS
Sources
cve.org  ·  NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
PoC
Automatable
yes
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
nyariv SandboxJS — < 0.8.29
Weakness (CWE)
CWESourceDescription
CWE-367 cna CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
CVSS scores (1)
ScoreSeverityVersionSourceVector
10.0 CRITICAL 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References (3)
Back to overview