CVE-2026-43898 | SandboxJS is a JavaScript sandboxing library. Prior to 0.9.6… | CVSS 10.0 CRITICAL

Description

SandboxJS is a JavaScript sandboxing library. Prior to 0.9.6, sandbox-defined functions expose Function.caller, allowing sandboxed code to recover the internal LispType.Call runtime callback. That callback can then be invoked with attacker-controlled fake context and obj values to extract blocked host statics, recover the real host Function constructor, and execute arbitrary host JavaScript. This vulnerability is fixed in 0.9.6.

Metadata

CVE ID: CVE-2026-43898
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-05-04 16:11 UTC
Published: 2026-05-28 17:50 UTC
Last updated: 2026-05-28 19:32 UTC
Primary CWE: CWE-94
CWE-94: Improper Control of Generation of Code ('Code Inject…
Vendor / Product: nyariv / SandboxJS
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
nyariv	SandboxJS	—	< 0.9.6

Weakness (CWE)

CWE	Source	Description
CWE-94	cna	CWE-94: Improper Control of Generation of Code ('Code Injection')

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References (2)

https://github.com/nyariv/SandboxJS/security/advisories/GHSA-g8f2-4f4f-5jqw https://github.com/nyariv/SandboxJS/security/advisories/GHSA-g8f2-4f4f-5jqw
https://github.com/nyariv/SandboxJS/commit/826865251232611ec94078bab5a18ec875dad4a5 https://github.com/nyariv/SandboxJS/commit/826865251232611ec94078bab5a18ec875dad4a5