https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 04:06:30 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-280391 EUVD-2026-280391 https://cve.radiocsirt.org/vuln/euvd-2026-280391 https://cve.radiocsirt.org/vuln/fkie_cve-2026-34217 <p>SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, a scope modification vulnerability exists in @nyariv/sandboxjs. The vulnerability allows untrusted sandboxed code to leak internal interpreter objects through the new operator, exposing sandbox scope objects in the scope hierarchy to untrusted code; an unexpected and undesired exploit. While this could allow modifying scopes inside the sandbox, code evaluation remains sandboxed and prototypes remain protected throughout the execution. This vulnerability is fixed in 0.8.36.</p> <p>SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, a scope modification vulnerability exists in @nyariv/sandboxjs. The vulnerability allows untrusted sandboxed code to leak internal interpreter objects through the new operator, exposing sandbox scope objects in the scope hierarchy to untrusted code; an unexpected and undesired exploit. While this could allow modifying scopes inside the sandbox, code evaluation remains sandboxed and prototypes remain protected throughout the execution. This vulnerability is fixed in 0.8.36.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-34217 https://cve.radiocsirt.org/vuln/ghsa-hg73-4w7g-q96w <p><strong>Affected:</strong> npm: @nyariv/sandboxjs</p> <p>## Description</p> <p>A scope modification vulnerability exists in `@nyariv/sandboxjs` version 0.8.35 and below. The vulnerability allows untrusted sandboxed code to leak internal interpreter objects through the `new` operator, exposing sandbox scope objects in the scope hierarchy to untrusted code; an unexpected and undesired exploit. While this could allow modifying scopes inside the sandbox, code evaluation remains sandboxed and prototypes remain protected throughout the execution.</p> <p>## Vulnerable Code Location</p> <p>### Primary: The `New` Operator Handler</p> <p>**File**: `src/executor.ts`, lines 1275–1280</p> <p>```typescript addOps&lt;new (...args: unknown[]) =&gt; unknown, unknown[]&gt;( LispType.New, ({ done, a, b, context }) =&gt; { if (!context.ctx.globalsWhitelist.has(a) &amp;&amp; !context.ctx.sandboxedFunctions.has(a)) { throw new SandboxAccessError(`Object construction not allowed: ${a.constructor.name}`); } done(undefined, new a(...b)); // ← b is NOT sanitized, return is NOT sanitized }, ); ```</p> <p>This handler has **two missing sanitization steps**:</p> <p>1. **Arguments (`b`) are not passed through `valueOrProp()`** — Constructor arguments contain raw `Prop` objects (internal interpreter wrappers) instead of extracted values.</p> <p>2. **Return value is not passed through `getGlobalProp()` or `sanitizeArray()`** — The constructed object is returned directly to the execution tree without any sanitization.</p> <p>### Comparison: The `Call` Handler (Correctly Implemented)</p> <p>**File**: `src/executor.ts`…</p> <p><strong>Affected:</strong> npm: @nyariv/sandboxjs</p> <p>## Description</p> <p>A scope modification vulnerability exists in `@nyariv/sandboxjs` version 0.8.35 and below. The vulnerability allows untrusted sandboxed code to leak internal interpreter objects through the `new` operator, exposing sandbox scope objects in the scope hierarchy to untrusted code; an unexpected and undesired exploit. While this could allow modifying scopes inside the sandbox, code evaluation remains sandboxed and prototypes remain protected throughout the execution.</p> <p>## Vulnerable Code Location</p> <p>### Primary: The `New` Operator Handler</p> <p>**File**: `src/executor.ts`, lines 1275–1280</p> <p>```typescript addOps&lt;new (...args: unknown[]) =&gt; unknown, unknown[]&gt;( LispType.New, ({ done, a, b, context }) =&gt; { if (!context.ctx.globalsWhitelist.has(a) &amp;&amp; !context.ctx.sandboxedFunctions.has(a)) { throw new SandboxAccessError(`Object construction not allowed: ${a.constructor.name}`); } done(undefined, new a(...b)); // ← b is NOT sanitized, return is NOT sanitized }, ); ```</p> <p>This handler has **two missing sanitization steps**:</p> <p>1. **Arguments (`b`) are not passed through `valueOrProp()`** — Constructor arguments contain raw `Prop` objects (internal interpreter wrappers) instead of extracted values.</p> <p>2. **Return value is not passed through `getGlobalProp()` or `sanitizeArray()`** — The constructed object is returned directly to the execution tree without any sanitization.</p> <p>### Comparison: The `Call` Handler (Correctly Implemented)</p> <p>**File**: `src/executor.ts`…</p> https://cve.radiocsirt.org/vuln/ghsa-hg73-4w7g-q96w