Vulnerabilities

TI-2026-31962 CVE-2026-43898 · GHSA-g8f2-4f4f-5jqw

SandboxJS: Sandbox escape via Function.caller leakage of internal call op

HIGH 82

SandboxJS is a JavaScript sandboxing library.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00472 Published 2026-05-28 Fixed in 0.9.6 CWE-94

TI-2026-26512 CVE-2026-34217 · GHSA-hg73-4w7g-q96w

SandboxJS has a Sandbox Escape via Prop Object Leak in New Handler

HIGH 70

SandboxJS is a JavaScript sandboxing library.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00304 Published 2026-04-06 Fixed in 0.8.36 CWE-668

TI-2026-26506 CVE-2026-34211 · GHSA-8pfc-jjgw-6g26

SandboxJS: Stack overflow DoS via deeply nested expressions in recursive descent parser

HIGH 70

SandboxJS is a JavaScript sandboxing library.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0041 Published 2026-04-06 Fixed in 0.8.36 CWE-674

TI-2026-26503 CVE-2026-34208 · GHSA-2gg9-6p7w-6cpj

SandboxJS: Sandbox integrity escape

HIGH 82

SandboxJS is a JavaScript sandboxing library.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00581 Published 2026-04-06 Fixed in 0.8.36 CWE-693

TI-2026-25215 CVE-2026-32723 · GHSA-7p5m-xrh7-769r

SandboxJS timers have an execution-quota bypass (cross-sandbox currentTicks race)

MEDIUM 55

SandboxJS is a JavaScript sandboxing library.

CVSS 4.0MEDIUM 4.8 Local Low privileges No interaction EPSS 0.00157 Published 2026-03-18 Fixed in 0.8.35 CWE-362

TI-2026-21440 CVE-2026-26954 · GHSA-6r9f-759j-hjgv

SandboxJS has a Sandbox Escape

HIGH 82

SandboxJS is a JavaScript sandboxing library.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00622 Published 2026-03-13 Fixed in 0.8.34 CWE-94

TI-2026-20921 CVE-2026-25881 · GHSA-ww7g-4gwx-m7wj

@nyariv/sandboxjs has host prototype pollution from sandbox via array intermediary (sandbox escape)

MEDIUM 44

SandboxJS is a JavaScript sandboxing library.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00613 Published 2026-02-09 Fixed in 0.8.31 CWE-1321

TI-2026-20693 CVE-2026-25586 · GHSA-jjpw-65fv-8g48

SandboxJS has a Sandbox Escape via Prototype Whitelist Bypass and Host Prototype Pollution

HIGH 82

SandboxJS is a JavaScript sandboxing library.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00692 Published 2026-02-06 Fixed in 0.8.29 CWE-74

TI-2026-20629 CVE-2026-25520 · GHSA-58jh-xv4v-pcx4

SandboxJS has a Sandbox Escape

HIGH 82

SandboxJS is a JavaScript sandboxing library.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.0085 Published 2026-02-06 Fixed in 0.8.29 CWE-74

TI-2026-20694 CVE-2026-25587 · GHSA-66h4-qj4x-38xp

SandboxJS has a Sandbox Escape

HIGH 82

SandboxJS is a JavaScript sandboxing library.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00701 Published 2026-02-06 Fixed in 0.8.29 CWE-94

TI-2026-20741 CVE-2026-25641 · GHSA-7x3h-rm86-3342

SandboxJS has a sandbox escape via TOCTOU bug on keys in property accesses

HIGH 82

SandboxJS is a JavaScript sandboxing library.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00521 Published 2026-02-06 Fixed in 0.8.29 CWE-367

TI-2026-20304 CVE-2026-25142 · GHSA-9p4w-fq8m-2hp7

SandboxJS Prototype Pollution -> Sandbox Escape -> RCE

MEDIUM 51

SandboxJS is a JavaScript sandboxing library.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01213 Published 2026-02-02 Fixed in 0.8.27 CWE-94

TI-2026-19195 CVE-2026-23830 · GHSA-wxhw-j4hc-fmq6

SandboxJS has Sandbox Escape via Unprotected AsyncFunction Constructor

HIGH 82

SandboxJS is a JavaScript sandboxing library.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01219 Published 2026-01-27 Fixed in 0.8.26 CWE-693

Vulnerabilities

Filters