https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 13:48:05 +0000 https://cve.radiocsirt.org/vuln/cve-2026-32723 <p><strong>Affected:</strong> nyariv SandboxJS</p> <p>SandboxJS is a JavaScript sandboxing library. Prior to 0.8.35, SandboxJS timers have an execution-quota bypass. A global tick state (`currentTicks.current`) is shared between sandboxes. Timer string handlers are compiled at execution time using that global tick state rather than the scheduling sandbox&#39;s tick object. In multi-tenant / concurrent sandbox scenarios, another sandbox can overwrite `currentTicks.current` between scheduling and execution, causing the timer callback to run under a different sandbox&#39;s tick budget and bypass the original sandbox&#39;s execution quota/watchdog. Version 0.8.35 fixes this issue.</p> <p><strong>Affected:</strong> nyariv SandboxJS</p> <p>SandboxJS is a JavaScript sandboxing library. Prior to 0.8.35, SandboxJS timers have an execution-quota bypass. A global tick state (`currentTicks.current`) is shared between sandboxes. Timer string handlers are compiled at execution time using that global tick state rather than the scheduling sandbox&#39;s tick object. In multi-tenant / concurrent sandbox scenarios, another sandbox can overwrite `currentTicks.current` between scheduling and execution, causing the timer callback to run under a different sandbox&#39;s tick budget and bypass the original sandbox&#39;s execution quota/watchdog. Version 0.8.35 fixes this issue.</p> https://cve.radiocsirt.org/vuln/cve-2026-32723