SandboxJS
Nyariv · 14 CVEs
SandboxJS: Sandbox escape via Function.caller leakage of internal call op
May 28, 2026
SandboxJS has a Sandbox Escape via Prop Object Leak in New Handler
Apr 6, 2026
SandboxJS: Stack overflow DoS via deeply nested expressions in recursive descent parser
Apr 6, 2026
SandboxJS: Sandbox integrity escape
Apr 6, 2026
SandboxJS timers have an execution-quota bypass (cross-sandbox currentTicks race)
Mar 18, 2026
SandboxJS has a Sandbox Escape
Mar 13, 2026
@nyariv/sandboxjs has host prototype pollution from sandbox via array intermediary (sandbox escape)
Feb 9, 2026
SandboxJS has a Sandbox Escape via Prototype Whitelist Bypass and Host Prototype Pollution
Feb 6, 2026
SandboxJS has a Sandbox Escape
Feb 6, 2026
SandboxJS has a Sandbox Escape
Feb 6, 2026
SandboxJS has a sandbox escape via TOCTOU bug on keys in property accesses
Feb 6, 2026
SandboxJS Prototype Pollution -> Sandbox Escape -> RCE
Feb 2, 2026
SandboxJS has Sandbox Escape via Unprotected AsyncFunction Constructor
Jan 27, 2026
nyariv sandboxjs 0.8.23 Prototype Pollution Sandbox Escape DoS
Jul 31, 2025
| CVE ID | Description | Severity | EPSS | Published |
|---|---|---|---|---|
| CVE-2026-43898 | SandboxJS: Sandbox escape via Function.caller leakage of internal call op | CRITICAL | 0.63% | May 28, 2026 |
| CVE-2026-34217 | SandboxJS has a Sandbox Escape via Prop Object Leak in New Handler | MEDIUM | 0.35% | Apr 6, 2026 |
| CVE-2026-34211 | SandboxJS: Stack overflow DoS via deeply nested expressions in recursive descent parser | MEDIUM | 0.49% | Apr 6, 2026 |
| CVE-2026-34208 | SandboxJS: Sandbox integrity escape | CRITICAL | 0.60% | Apr 6, 2026 |
| CVE-2026-32723 | SandboxJS timers have an execution-quota bypass (cross-sandbox currentTicks race) | MEDIUM | 0.12% | Mar 18, 2026 |
| CVE-2026-26954 | SandboxJS has a Sandbox Escape | CRITICAL | 0.60% | Mar 13, 2026 |
| CVE-2026-25881 | @nyariv/sandboxjs has host prototype pollution from sandbox via array intermediary (sandbox escape) | CRITICAL | 0.65% | Feb 9, 2026 |
| CVE-2026-25586 | SandboxJS has a Sandbox Escape via Prototype Whitelist Bypass and Host Prototype Pollution | CRITICAL | 0.73% | Feb 6, 2026 |
| CVE-2026-25520 | SandboxJS has a Sandbox Escape | CRITICAL | 0.89% | Feb 6, 2026 |
| CVE-2026-25587 | SandboxJS has a Sandbox Escape | CRITICAL | 0.73% | Feb 6, 2026 |
| CVE-2026-25641 | SandboxJS has a sandbox escape via TOCTOU bug on keys in property accesses | CRITICAL | 0.58% | Feb 6, 2026 |
| CVE-2026-25142 | SandboxJS Prototype Pollution -> Sandbox Escape -> RCE | CRITICAL | 1.23% | Feb 2, 2026 |
| CVE-2026-23830 | SandboxJS has Sandbox Escape via Unprotected AsyncFunction Constructor | CRITICAL | 1.25% | Jan 27, 2026 |
| CVE-2025-34146 | nyariv sandboxjs 0.8.23 Prototype Pollution Sandbox Escape DoS | HIGH | 0.21% | Jul 31, 2025 |
Showing 1 to 14 of 14 CVEs