Critical severity · published Feb 6, 2026
CVE-2026-25520
SandboxJS has a Sandbox Escape
10.0
CVSS
0.9%
EPSS
No
On KEV
Description
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, The return values of functions aren't wrapped. Object.values/Object.entries can be used to get an Array containing the host's Function constructor, by using Array.prototype.at you can obtain the hosts Function constructor, which can be used to execute arbitrary code outside of the sandbox. This vulnerability is fixed in 0.8.29.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
SandboxJS · nyariv
< 0.8.29 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-25520
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-25520
Patch
https://github.com/nyariv/SandboxJS/commit/67cb186c41c78c51464f70405504e8ef0a6e43c3
Exploit
https://github.com/nyariv/SandboxJS/security/advisories/GHSA-58jh-xv4v-pcx4
More from SandboxJS
10.0
CVE-2026-43898
SandboxJS: Sandbox escape via Function.caller leakage of internal call op
10.0
CVE-2026-34208
SandboxJS: Sandbox integrity escape
10.0
CVE-2026-26954
SandboxJS has a Sandbox Escape
10.0
CVE-2026-25881
@nyariv/sandboxjs has host prototype pollution from sandbox via array intermediary (sandbox escape)
10.0
CVE-2026-25586
SandboxJS has a Sandbox Escape via Prototype Whitelist Bypass and Host Prototype Pollution