CVE Intelligence
Analysis AI-assisted

CVE-2026-25142: SandboxJS sandbox escape via __lookupGetter__ prototype access

SandboxJS versions before 0.8.27 do not properly restrict __lookupGetter__, which the record says can be used to obtain prototypes, enabling a sandbox escape and possible remote code execution. The GitHub advisory provider rates it critical with a CVSS 3.1 base score of 10. The record identifies 0.8.27 as the fixed version and reports no confirmed active exploitation.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

SandboxJS is a JavaScript sandboxing library. According to the record, versions before 0.8.27 do not properly restrict __lookupGetter__, which can be used to obtain prototypes. The record classifies the weakness as CWE-1321 (Prototype Pollution) and states that it is fixed in 0.8.27.

Impact

  • The record states that the weakness can be used to escape the sandbox and achieve remote code execution.
  • The CVSS 3.1 base score recorded by the GitHub Security Advisories provider is 10 (critical). The vector indicates network access, no privileges or user interaction required, scope change, and high confidentiality, integrity and availability impact.

Affected products and versions

  • Product: Nyariv SandboxJS.
  • Affected range: versions before 0.8.27.
  • Fixed version: 0.8.27.
  • The record links a patch commit in the SandboxJS repository.

Exploitation status

The record shows that this CVE is not listed in the CISA KEV catalog. No confirmed active exploitation appears in the sources consulted. One reference in the record carries an Exploit tag, but that tag alone does not confirm exploitation in the wild. No EPSS score is available.

Remediation and mitigation

  • Upgrade SandboxJS to version 0.8.27 or later, as identified in the GitHub advisory.
  • If an immediate upgrade is not possible, reduce exposure by avoiding execution of untrusted code in the sandbox and by running it in an isolated process with minimal privileges.
  • The record does not describe any specific workaround.

Detection guidance

  • Inventory dependencies and lockfiles to find where SandboxJS is used and which version is present.
  • Review application paths that pass user or third-party input into the sandbox.
  • Monitor for unexpected child processes, unusual outbound network connections and anomalous errors originating from the runtime that hosts the sandbox.

Limitations of the available information

  • The record does not include technical exploitation details or proof-of-concept material, and this analysis does not provide them.
  • This analysis relies only on the data in the record and the cited references; the full advisory text was not independently reviewed.
  • No EPSS or SSVC data is present in the record.
  • The record has no title, so the title was written from the description and affected product.

Frequently asked questions

Is this vulnerability fixed?

According to the record, it is fixed in version 0.8.27, and the record links a patch commit in the SandboxJS repository.

Is it being exploited in the wild?

The record shows it is not listed in the CISA KEV catalog, and no confirmed active exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.