TI-2025-24300 Aliases CVE-2025-34146 GHSA-9qm3-6qrr-c76m

nyariv sandboxjs 0.8.23 Prototype Pollution Sandbox Escape DoS

MEDIUM 64CWE-1321Published 2025-07-31 · Updated 2026-10-08

Key facts

Attack vector: Local
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: None · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

A prototype pollution vulnerability exists in @nyariv/sandboxjs versions <= 0.8.23, allowing attackers to inject arbitrary properties into Object.prototype via crafted JavaScript code. This can result in a denial-of-service (DoS) condition or, under certain conditions, escape the sandboxed environment intended to restrict code execution. The vulnerability stems from insufficient prototype access checks in the sandbox’s executor logic, particularly in the handling of JavaScript function objects returned.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00245 15th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix Fixed @nyariv/sandboxjs (npm): 0.8.24

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
nyariv	sandboxjs	up to 0.8.23	—	No fix listed	CNA
—	@nyariv/sandboxjs (npm)	before 0.8.24	0.8.24	Patch available	GHSA-9qm3-6qrr-c76m

sandboxjs Vendornyariv Affected up to 0.8.23 Fixed in — No fix listed CNA
@nyariv/sandboxjs (npm) Vendor— Affected before 0.8.24 Fixed in 0.8.24 Patch available GHSA-9qm3-6qrr-c76m

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:nyariv:sandboxjs::::::::	—	—	nyariv

cpe:2.3:a:nyariv:sandboxjs:*:*:*:*:*:*:*:* Versions — — ·nyariv

Remediation

Fix · GHSA-9qm3-6qrr-c76m @nyariv/sandboxjs (npm) Fixed in 0.8.24 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-34146
2026-10-03 Alias added: GHSA-9qm3-6qrr-c76m

References

Exploit 1

https://gist.github.com/Hagrid29/9df27829a491080f923c4f6b8518d7e3

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-34146

Other 3

TI-2026-31962 SandboxJS: Sandbox escape via Function.caller leakage of internal call op CVSS 3.1CRITICAL 10.0
TI-2026-26503 SandboxJS: Sandbox integrity escape CVSS 3.1CRITICAL 10.0
TI-2026-21440 SandboxJS has a Sandbox Escape CVSS 3.1CRITICAL 10.0
TI-2026-20741 SandboxJS has a sandbox escape via TOCTOU bug on keys in property accesses CVSS 3.1CRITICAL 10.0
TI-2026-20694 SandboxJS has a Sandbox Escape CVSS 3.1CRITICAL 10.0
TI-2026-20693 SandboxJS has a Sandbox Escape via Prototype Whitelist Bypass and Host Prototype Pollution CVSS 3.1CRITICAL 10.0

See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences