https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 02:37:26 +0000 https://cve.radiocsirt.org/vuln/cve-2026-25520 <p><strong>Affected:</strong> nyariv SandboxJS</p> <p>SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, The return values of functions aren&#39;t wrapped. Object.values/Object.entries can be used to get an Array containing the host&#39;s Function constructor, by using Array.prototype.at you can obtain the hosts Function constructor, which can be used to execute arbitrary code outside of the sandbox. This vulnerability is fixed in 0.8.29.</p> <p><strong>Affected:</strong> nyariv SandboxJS</p> <p>SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, The return values of functions aren&#39;t wrapped. Object.values/Object.entries can be used to get an Array containing the host&#39;s Function constructor, by using Array.prototype.at you can obtain the hosts Function constructor, which can be used to execute arbitrary code outside of the sandbox. This vulnerability is fixed in 0.8.29.</p> https://cve.radiocsirt.org/vuln/cve-2026-25520