CVE Intelligence
Analysis AI-assisted

CVE-2026-25586: SandboxJS: sandbox escape leading to prototype pollution

SandboxJS, a JavaScript sandboxing library, is affected by a sandbox escape in versions before 0.8.29. The flaw lets an attacker bypass prototype whitelist enforcement and pollute the host Object.prototype, with possible persistent effects across sandboxes. GitHub rates it Critical (CVSS 3.1 base score 10), and upgrading to 0.8.29 is the documented fix.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

SandboxJS is a JavaScript sandboxing library. According to the GitHub Security Advisory GHSA-jjpw-65fv-8g48, versions before 0.8.29 allow a sandbox escape that weakens prototype whitelist enforcement and can lead to pollution of the host Object.prototype. The record classifies the weakness as CWE-74 (Injection).

Impact

  • The recorded CVSS 3.1 base score is 10 (Critical), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, as provided by GitHub.
  • The description states that the impact includes host prototype pollution and persistent cross-sandbox effects.
  • The vector marks scope as changed and confidentiality, integrity and availability as High.

Affected products and versions

  • Product: Nyariv SandboxJS (listed in the record as Nyariv Sandboxjs).
  • Affected range recorded: versions below 0.8.29.
  • Fixed version: 0.8.29, as stated in the description and the patch commit.

Exploitation status

The record shows the CVE is not listed in the CISA KEV catalog. No confirmed active exploitation appears in the sources consulted. One reference is tagged as Exploit in the record, but that tag alone does not confirm exploitation in the wild.

Remediation and mitigation

  • Upgrade SandboxJS to version 0.8.29 or later, the version that carries the fix.
  • Inventory direct and transitive dependencies to locate every copy of the library, including nested copies in lockfiles.
  • Prioritize applications that run semi-trusted or user-supplied code inside the sandbox, since that is where the escape matters most.
  • The sources consulted do not document workarounds other than upgrading, so any additional mitigation should be validated by the owning team.

Detection guidance

  • Check software bills of materials and package manifests for SandboxJS versions below 0.8.29.
  • Monitor host processes for unexpected changes to built-in prototype objects, which would be consistent with prototype pollution.
  • Review application logs around sandboxed execution for anomalies after deployment, without relying on any specific attack pattern.

Limitations of the available information

  • The record does not describe real-world deployments, affected application types, or any workaround beyond upgrading.
  • The EPSS entry is dated 2026-10-13, which is later than the publication date of 2026-02-06 in the record; this date should be verified against the EPSS source before use.
  • The record does not include a separate NVD assessment, so the CVSS data relies on the GitHub-provided score.

Frequently asked questions

Which SandboxJS versions are affected by CVE-2026-25586?

The record lists versions below 0.8.29 as affected. Upgrading to 0.8.29 is the fixed version named in the description and the patch reference.

Is this vulnerability being actively exploited?

The record shows the CVE is not listed in CISA KEV, and no confirmed active exploitation appears in the sources consulted. Teams should still prioritize the upgrade given the Critical rating.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.