SandboxJS is a JavaScript sandboxing library. Prior to 0.8.31, a sandbox escape vulnerability allows sandboxed code to mutate host built-in prototypes by laundering the isGlobal protection flag through array literal intermediaries. When a global prototype reference (e.g., Map.prototype, Set.prototype) is placed into an array and retrieved, the isGlobal taint is stripped, permitting direct prototype mutation from within the sandbox. This results in persistent host-side prototype pollution and may enable RCE in applications that use polluted properties in sensitive sinks (example gadget: execSync(obj.cmd)). This vulnerability is fixed in 0.8.31.
The isGlobal protection mechanism, which is designed to block mutation of host built-in prototypes, can be bypassed by placing a global reference to a prototype (e.g., Map.prototype, Set.prototype) in an array literal. After retrieving the value from the array, the isGlobal flag is lost, allowing code running in the sandbox to directly mutate prototypes on the host side. As a result, prototype pollution is permanent and visible outside the sandbox. If the application uses polluted properties in critical calls (e.g., execSync(obj.cmd)), arbitrary system code execution is possible.
An attacker can permanently modify prototypes of built-in JavaScript objects on the host side, which under favorable conditions leads to remote code execution (RCE) on the server or in the application runtime environment.
The SandboxJS library should be updated to version 0.8.31 or later, in which the vulnerability has been fixed. Details are available in the official security advisory and the vendor's commit.
Nyariv SandboxJS in versions before 0.8.31
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:HNyariv Sandboxjs
APPNyariv< 0.8.31
Related vulnerabilities
SandboxJS: ucieczka z piaskownicy przez Function.caller i RCE
SandboxJS: obejście ochrony sandbox przez ścieżkę konstruktora
Ucieczka z sandbox w bibliotece Nyariv SandboxJS (RCE)
Ucieczka z sandboxa w SandboxJS — wykonanie kodu poza piaskownicą
Ucieczka z sandboxa w bibliotece SandboxJS poprzez nadpisanie Map.prototype