CRITICAL🇵🇱 Wersja polska

CVE-2026-25881

CVSS 9.0v3.1pub. 2026-02-09upd. 2026-02-18

SandboxJS is a JavaScript sandboxing library. Prior to 0.8.31, a sandbox escape vulnerability allows sandboxed code to mutate host built-in prototypes by laundering the isGlobal protection flag through array literal intermediaries. When a global prototype reference (e.g., Map.prototype, Set.prototype) is placed into an array and retrieved, the isGlobal taint is stripped, permitting direct prototype mutation from within the sandbox. This results in persistent host-side prototype pollution and may enable RCE in applications that use polluted properties in sensitive sinks (example gadget: execSync(obj.cmd)). This vulnerability is fixed in 0.8.31.

🤖 AI Analysis
How it works

The isGlobal protection mechanism, which is designed to block mutation of host built-in prototypes, can be bypassed by placing a global reference to a prototype (e.g., Map.prototype, Set.prototype) in an array literal. After retrieving the value from the array, the isGlobal flag is lost, allowing code running in the sandbox to directly mutate prototypes on the host side. As a result, prototype pollution is permanent and visible outside the sandbox. If the application uses polluted properties in critical calls (e.g., execSync(obj.cmd)), arbitrary system code execution is possible.

Impact

An attacker can permanently modify prototypes of built-in JavaScript objects on the host side, which under favorable conditions leads to remote code execution (RCE) on the server or in the application runtime environment.

Mitigation & patch

The SandboxJS library should be updated to version 0.8.31 or later, in which the vulnerability has been fixed. Details are available in the official security advisory and the vendor's commit.

Who is affected

Nyariv SandboxJS in versions before 0.8.31

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
  • Nyariv Sandboxjs

    APP
    Nyariv
    < 0.8.31
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2026-43898CRITICAL10.0PL ✓same product

SandboxJS: ucieczka z piaskownicy przez Function.caller i RCE

CVE-2026-34208CRITICAL10.0PL ✓same product

SandboxJS: obejście ochrony sandbox przez ścieżkę konstruktora

CVE-2026-26954CRITICAL10.0PL ✓same product

Ucieczka z sandbox w bibliotece Nyariv SandboxJS (RCE)

CVE-2026-25520CRITICAL10.0PL ✓same product

Ucieczka z sandboxa w SandboxJS — wykonanie kodu poza piaskownicą

CVE-2026-25587CRITICAL10.0PL ✓same product

Ucieczka z sandboxa w bibliotece SandboxJS poprzez nadpisanie Map.prototype