CVE-2026-25641: SandboxJS Sandbox Escape via Property Key Coercion
CVE-2026-25641 is a critical sandbox escape in SandboxJS, a JavaScript sandboxing library, affecting versions before 0.8.29. The record describes a mismatch between the property key that is validated and the key used for the actual property access, caused by objects that coerce to different string values. The fix is available in 0.8.29, and no confirmed exploitation appears in the sources consulted.
Overview
SandboxJS is a JavaScript sandboxing library. According to the record, versions before 0.8.29 contain a sandbox escape caused by a mismatch between the key that is validated and the key used for property access. The record states that the key is annotated as string but this is never enforced, so an object can produce different string values at the validation step and at the access step. The record states the vulnerability is fixed in 0.8.29.
Impact
- NVD assigns a CVSS 3.1 base score of 9 with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, and the GitHub CNA assigns 10 in the same version.
- The vector indicates high confidentiality, integrity and availability impact with a changed scope.
- A sandbox escape would mean code running inside the sandbox could reach resources of the host environment. This is an inference from the description and the vector, not a statement made in the record.
Affected products and versions
- The record lists Nyariv Sandboxjs with versions less than 0.8.29 as affected.
- The record links a patch commit that corresponds to the fix in 0.8.29.
Exploitation status
The CISA KEV catalog does not list this CVE in the record, so no confirmed active exploitation can be stated. No confirmed exploitation in the wild appears in the sources consulted. The EPSS probability in the record is 0.00576 with a percentile of 0.45998. The GitHub advisory reference is tagged Exploit in the record, but that tag alone does not confirm exploitation.
Remediation and mitigation
- Upgrade SandboxJS to version 0.8.29 or later, which the record identifies as the fixed version.
- Review any application that runs untrusted or user-supplied code through SandboxJS and prioritize upgrading those deployments.
- Where immediate upgrade is not possible, reduce exposure by limiting which inputs can reach the sandbox. The record does not describe a specific workaround.
Detection guidance
- Inventory dependencies to identify where SandboxJS is used and which version is installed.
- Monitor applications that execute untrusted code for unexpected behavior that could indicate sandbox boundary violations. This is a general high-level recommendation, not a signature from the record.
Limitations of the available information
- The record's CWE is CWE-367 (TOCTOU Race Condition), while the description reads as a property key coercion and validation mismatch. Whether the classification matches the root cause is unknown from the record alone.
- The record has no title in English, so the title here is an editorial summary.
- The sources do not provide a proof of concept or detailed technical analysis beyond the description, and this analysis does not include such material.
- The EPSS date in the record is not verified against an independent source.
Frequently asked questions
Which versions of SandboxJS are affected by CVE-2026-25641?
The record lists Nyariv Sandboxjs versions less than 0.8.29 as affected, and states the vulnerability is fixed in 0.8.29.
Is CVE-2026-25641 known to be actively exploited?
The record shows this CVE is not listed in the CISA KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted.
What is the CVSS score for CVE-2026-25641?
NVD assigns a CVSS 3.1 base score of 9 and the GitHub CNA assigns 10. The record gives the NVD vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.