CVE Intelligence
Analysis AI-assisted

CVE-2026-25587: SandboxJS sandbox escape via exposed Map prototype

SandboxJS, a JavaScript sandboxing library, has a critical vulnerability in versions before 0.8.29 that allows the sandbox to be escaped. According to the record, Map is included in the SAFE_PROTOYPES list, so its prototype can be reached and overwriting Map.prototype.has breaks the isolation. The issue is fixed in 0.8.29, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

SandboxJS is a JavaScript sandboxing library. The record states that before 0.8.29 Map is included in the SAFE_PROTOYPES list, which makes its prototype reachable from inside the sandbox. The record classifies the weakness as CWE-94 (Code Injection).

Impact

  • The record describes a sandbox escape, meaning code running inside the sandbox may act outside its intended isolation.
  • The CVSS 3.1 base score supplied by the CNA is 10.0, with high confidentiality, integrity and availability impact and a changed scope.
  • Inference: applications that run untrusted JavaScript through SandboxJS on an affected version should treat this as high risk.

Affected products and versions

  • Product: Nyariv Sandboxjs (SandboxJS).
  • Affected range: versions prior to 0.8.29.
  • Fixed in: 0.8.29, according to the record.
  • The record lists no other affected branches.

Exploitation status

  • CISA KEV: not listed in the record.
  • No confirmed active exploitation or exploited in the wild status appears in the sources consulted.
  • The GitHub advisory is tagged as Exploit in the record. Its content was not reviewed for this analysis, so no exploitation details are provided here.

Remediation and mitigation

  • Upgrade SandboxJS to version 0.8.29 or later. The fix commit is referenced in the record.
  • If an upgrade cannot be applied immediately, reduce exposure by avoiding untrusted code in the sandbox and by adding operating system or container isolation around the process. This is general defensive guidance, not a vendor recommendation.
  • Review the vendor advisory for any further guidance.

Detection guidance

  • Inventory applications and dependencies to identify SandboxJS installations below 0.8.29.
  • Review logs from components that use the sandbox for unexpected errors or unusual interactions with host objects.
  • The record provides no specific detection signatures. Any monitoring rules should be validated by the defending team.

Limitations of the available information

  • The record does not describe a proof of concept, a detailed exploitation path or real-world incidents.
  • The record contains EPSS values (probability 0.00734, percentile 0.53186) with a date of 2026-10-13, which should be verified against the source.
  • Whether a given product uses SandboxJS, and in which version, is unknown and must be checked locally.

Frequently asked questions

Which SandboxJS versions are affected by CVE-2026-25587?

According to the record, versions prior to 0.8.29 are affected. The issue is fixed in 0.8.29.

Is this vulnerability being actively exploited?

The record shows that the vulnerability is not listed in CISA KEV, and no confirmed active exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.