CVE-2026-25520

SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, The return values of functions aren't wrapped. Object.values/Object.entries can be used to get an Array containing the host's Function constructor, by using Array.prototype.at you can obtain the hosts Function constructor, which can be used to execute arbitrary code outside of the sandbox. This vulnerability is fixed in 0.8.29.

Scoring

Severity
CRITICAL
CVSS base score
10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS probability
0.80%
CWE
CWE-74
Published
2026-02-06
Last modified
2026-03-12

Affected products

Weakness type

Related vulnerabilities

Markdown version · Browse all CVEs