CVE Intelligence
Analysis AI-assisted

CVE-2026-25520: SandboxJS: sandbox escape via unwrapped function return values

CVE-2026-25520 affects SandboxJS versions prior to 0.8.29, where function return values are not wrapped, allowing host objects to be reached from inside the sandbox. The record describes a path to run arbitrary code outside the sandbox, and it is fixed in 0.8.29. The CVSS 3.1 base score recorded is 10.0 (critical), and the CISA KEV catalog does not list it.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

SandboxJS is a JavaScript sandboxing library. According to the record, before version 0.8.29 the return values of functions were not wrapped, which allowed host objects to be reached from inside the sandbox. The vendor advisory is GHSA-58jh-xv4v-pcx4 and the fix is commit 67cb186.

Impact

  • The record lists a CVSS 3.1 base score of 10.0 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, provided by the GitHub Security Advisories CNA.
  • The description states that the issue can be used to execute arbitrary code outside the sandbox.
  • The scope metric is recorded as changed, which suggests impact may extend beyond the vulnerable component (inference from the vector).

Affected products and versions

  • Product: Nyariv Sandboxjs, versions less than 0.8.29.
  • The record states the vulnerability is fixed in 0.8.29.

Exploitation status

The CISA KEV catalog does not list this CVE. No confirmed active exploitation appears in the sources consulted. One reference is tagged as Exploit, but that tag alone does not confirm exploitation in the wild.

Remediation and mitigation

  • Upgrade SandboxJS to version 0.8.29 or later.
  • Review the patch commit to confirm the change in your build.
  • If an immediate upgrade is not possible, stop running untrusted code inside the sandbox and treat the sandbox as not a security boundary (inference).
  • Run the host process with least privilege so that a sandbox failure has limited reach (inference).

Detection guidance

  • Inventory applications and dependencies that include SandboxJS and record the installed versions.
  • Monitor for unexpected process, file or network activity originating from the host application that runs sandboxed scripts.
  • Review application logs for sandboxed scripts that behave outside their expected scope.

Limitations of the available information

  • The record gives only a lower bound of 'less than 0.8.29' and does not list intermediate versions.
  • The record does not describe detection signatures or indicators of compromise.
  • Downstream products that embed SandboxJS are not listed in the record.
  • The EPSS values are probabilistic estimates and do not confirm exploitation.

Frequently asked questions

Which SandboxJS versions are affected by CVE-2026-25520?

The record lists versions less than 0.8.29 as affected. The issue is fixed in 0.8.29.

Is CVE-2026-25520 known to be actively exploited?

The CISA KEV catalog does not list this CVE, and no confirmed active exploitation appears in the sources consulted.

What should administrators do?

Upgrade SandboxJS to 0.8.29 or later. If that is not immediately possible, avoid running untrusted code in the sandbox and apply least privilege to the host process.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.