Code Red: 4 Critical SandboxJS Flaws (CVSS 10.0) Allow Host Takeover

A quartet of critical vulnerabilities has been discovered in SandboxJS, a library designed to isolate and secure JavaScript execution. The flaws, tracked as CVE-2026-25520, CVE-2026-25586, CVE-2026-25587, and CVE-2026-25641, all carry a maximum CVSS score of 10.0, allowing attackers to completely break out of the sandbox and execute arbitrary code on the host system.

For developers relying on SandboxJS to run untrusted code safely, these findings are a “code red” alert. The library’s promise of security has been fundamentally compromised by multiple avenues of attack that bypass its core protections.

The first vulnerability (CVE-2026-25520) exploits a loophole in how the library handles function return values. Normally, a sandbox wraps objects to prevent them from interacting with the outside world. However, this flaw allows an attacker to access the host’s Function constructor through a chain of method calls.

“The return values of functions aren’t wrapped,” the advisory explains. Attackers can use Object.values or Object.entries to retrieve an array containing the host’s constructor, effectively handing them the keys to the engine.

The second flaw (CVE-2026-25587) targets the Map object, which is typically considered safe. The vulnerability lies in a bug within the library’s let implementation, which allows attackers to overwrite the Map.prototype.has method.

“As Map is in SAFE_PROTOYPES, it’s prototype can be obtained via Map.prototype,” the advisory notes. By overwriting this core method, an attacker can manipulate the sandbox’s internal logic and escape its confinement.

Perhaps the most dangerous of the group is CVE-2026-25586, which allows for “Host Prototype Pollution.” This vulnerability exploits the way SandboxJS checks for properties using hasOwnProperty.

The flaw allows an attacker to “shadow” or replace hasOwnProperty on a sandboxed object. “When this returns true, the whitelist checks are skipped,” the advisory warns. This simple trick disables the safety checks that prevent access to sensitive prototypes like __proto__, giving the attacker free rein to pollute the host environment.

The final vulnerability (CVE-2026-25641) is a classic “Time-of-Check to Time-of-Use” (TOCTOU) bug. The issue arises because the library validates a property key at one moment but uses it at another, without ensuring it hasn’t changed.

“Attackers can pass malicious objects that coerce to different string values when used,” the advisory explains. An attacker can provide a key that looks safe during the security check but transforms into a malicious payload when the property is actually accessed.

All four vulnerabilities affect SandboxJS versions 0.8.28 and earlier. The maintainers have released a comprehensive patch in version 0.8.29.

Related Posts:

• CVE-2026-23830: Critical SandboxJS Flaw (CVSS 10) Allows Total Sandbox Escape
• Kibana Code Injection Vulnerability: Prototype Pollution Threat (CVE-2024-12556)
• CVE-2025-25014 (CVSS 9.1): Prototype Pollution in Kibana Opens Door to Code Execution
• Windows Sandbox Gets Supercharged: Clipboard and File Sharing Arrive