CVE-2026-25586 PUBLISHED

SandboxJS has a Sandbox Escape via Prototype Whitelist Bypass and Host Prototype Pollution

Assigner: GitHub_M
Reserved: 03.02.2026 Published: 06.02.2026 Updated: 06.02.2026

SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, a sandbox escape is possible by shadowing hasOwnProperty on a sandbox object, which disables prototype whitelist enforcement in the property-access path. This permits direct access to proto and other blocked prototype properties, enabling host Object.prototype pollution and persistent cross-sandbox impact. This vulnerability is fixed in 0.8.29.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 10

Product Status

Vendor nyariv
Product SandboxJS
Versions
  • Version < 0.8.29 is affected

References

Problem Types

  • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE