nyariv

Records14All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical10CVSS 9.0–10.0

CVSS high1CVSS 7.0–8.9

Exploited now

nyariv records in CISA KEV

No nyariv vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Sandboxjs 13 records HIGH

Records

13 records in Sandboxjs · all components

TI-2026-31962 CVE-2026-43898 · GHSA-g8f2-4f4f-5jqw

SandboxJS: Sandbox escape via Function.caller leakage of internal call op

HIGH 82

SandboxJS is a JavaScript sandboxing library.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00472 Published 2026-05-28 Fixed in 0.9.6 CWE-94

TI-2026-26503 CVE-2026-34208 · GHSA-2gg9-6p7w-6cpj

SandboxJS: Sandbox integrity escape

HIGH 82

SandboxJS is a JavaScript sandboxing library.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00581 Published 2026-04-06 Fixed in 0.8.36 CWE-693

TI-2026-21440 CVE-2026-26954 · GHSA-6r9f-759j-hjgv

SandboxJS has a Sandbox Escape

HIGH 82

SandboxJS is a JavaScript sandboxing library.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00569 Published 2026-03-13 Fixed in 0.8.34 CWE-94

TI-2026-20741 CVE-2026-25641 · GHSA-7x3h-rm86-3342

SandboxJS has a sandbox escape via TOCTOU bug on keys in property accesses

HIGH 82

SandboxJS is a JavaScript sandboxing library.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00521 Published 2026-02-06 Fixed in 0.8.29 CWE-367

TI-2026-20694 CVE-2026-25587 · GHSA-66h4-qj4x-38xp

SandboxJS has a Sandbox Escape

HIGH 82

SandboxJS is a JavaScript sandboxing library.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00701 Published 2026-02-06 Fixed in 0.8.29 CWE-94

TI-2026-20693 CVE-2026-25586 · GHSA-jjpw-65fv-8g48

SandboxJS has a Sandbox Escape via Prototype Whitelist Bypass and Host Prototype Pollution

HIGH 82

SandboxJS is a JavaScript sandboxing library.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00692 Published 2026-02-06 Fixed in 0.8.29 CWE-74

TI-2026-20629 CVE-2026-25520 · GHSA-58jh-xv4v-pcx4

SandboxJS has a Sandbox Escape

HIGH 82

SandboxJS is a JavaScript sandboxing library.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.0085 Published 2026-02-06 Fixed in 0.8.29 CWE-74

TI-2026-19195 CVE-2026-23830 · GHSA-wxhw-j4hc-fmq6

SandboxJS has Sandbox Escape via Unprotected AsyncFunction Constructor

HIGH 82

SandboxJS is a JavaScript sandboxing library.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01219 Published 2026-01-27 Fixed in 0.8.26 CWE-693

TI-2026-26512 CVE-2026-34217 · GHSA-hg73-4w7g-q96w

SandboxJS has a Sandbox Escape via Prop Object Leak in New Handler

HIGH 70

SandboxJS is a JavaScript sandboxing library.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00304 Published 2026-04-06 Fixed in 0.8.36 CWE-668

TI-2026-26506 CVE-2026-34211 · GHSA-8pfc-jjgw-6g26

SandboxJS: Stack overflow DoS via deeply nested expressions in recursive descent parser

HIGH 70

SandboxJS is a JavaScript sandboxing library.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0041 Published 2026-04-06 Fixed in 0.8.36 CWE-674

TI-2026-25215 CVE-2026-32723 · GHSA-7p5m-xrh7-769r

SandboxJS timers have an execution-quota bypass (cross-sandbox currentTicks race)

MEDIUM 55

SandboxJS is a JavaScript sandboxing library.

CVSS 4.0MEDIUM 4.8 Local Low privileges No interaction EPSS 0.00157 Published 2026-03-18 Fixed in 0.8.35 CWE-362

TI-2026-20304 CVE-2026-25142 · GHSA-9p4w-fq8m-2hp7

SandboxJS Prototype Pollution -> Sandbox Escape -> RCE

MEDIUM 51

SandboxJS is a JavaScript sandboxing library.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01213 Published 2026-02-02 Fixed in 0.8.27 CWE-94

TI-2026-20921 CVE-2026-25881 · GHSA-ww7g-4gwx-m7wj

@nyariv/sandboxjs has host prototype pollution from sandbox via array intermediary (sandbox escape)

MEDIUM 44

SandboxJS is a JavaScript sandboxing library.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00613 Published 2026-02-09 Fixed in 0.8.31 CWE-1321

Open these records in search →