Critical severity · published Mar 13, 2026
CVE-2026-26954
SandboxJS has a Sandbox Escape
10.0
CVSS
0.6%
EPSS
No
On KEV
Description
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.34, it is possible to obtain arrays containing Function, which allows escaping the sandbox. Given an array containing Function, and Object.fromEntries, it is possible to construct {[p]: Function} where p is any constructible property. This vulnerability is fixed in 0.8.34.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
SandboxJS · nyariv
< 0.8.34 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-26954
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-26954
Exploit
https://github.com/nyariv/SandboxJS/security/advisories/GHSA-6r9f-759j-hjgv
More from SandboxJS
10.0
CVE-2026-43898
SandboxJS: Sandbox escape via Function.caller leakage of internal call op
10.0
CVE-2026-34208
SandboxJS: Sandbox integrity escape
10.0
CVE-2026-25881
@nyariv/sandboxjs has host prototype pollution from sandbox via array intermediary (sandbox escape)
10.0
CVE-2026-25586
SandboxJS has a Sandbox Escape via Prototype Whitelist Bypass and Host Prototype Pollution
10.0
CVE-2026-25520
SandboxJS has a Sandbox Escape