Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 19:38:53 +0000 CVE-2026-25586 — SandboxJS has a Sandbox Escape via Prototype Whitelist Bypass and Host Prototype Pollution https://cve.radiocsirt.org/vuln/cve-2026-25586 <p><strong>Affected:</strong> nyariv SandboxJS</p> <p>SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, a sandbox escape is possible by shadowing hasOwnProperty on a sandbox object, which disables prototype whitelist enforcement in the property-access path. This permits direct access to __proto__ and other blocked prototype properties, enabling host Object.prototype pollution and persistent cross-sandbox impact. This vulnerability is fixed in 0.8.29.</p> <p><strong>Affected:</strong> nyariv SandboxJS</p> <p>SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, a sandbox escape is possible by shadowing hasOwnProperty on a sandbox object, which disables prototype whitelist enforcement in the property-access path. This permits direct access to __proto__ and other blocked prototype properties, enabling host Object.prototype pollution and persistent cross-sandbox impact. This vulnerability is fixed in 0.8.29.</p> https://cve.radiocsirt.org/vuln/cve-2026-25586