Vulnerability · Published Feb 6, 2026 · Assigned by GitHub_M

CVE-2026-25641SandboxJS has a sandbox escape via TOCTOU bug on keys in property accesses

Critical 10.0

In plain English

A critical-severity security flaw in SandboxJS from nyariv. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)10.0Critical

Exploit odds (30 days)0.5%top 55.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, there is a sandbox escape vulnerability due to a mismatch between the key on which the validation is performed and the key used for accessing properties. Even though the key used in property accesses is annotated as string, this is never enforced. So, attackers can pass malicious objects that coerce to different string values when used, e.g., one for the time the key is sanitized using hasOwnProperty(key) and a different one for when the key is used for the actual property access. This vulnerability is fixed in 0.8.29.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@nyariv/sandboxjs	0.8.29	GHSA-7x3h-rm86-3342

Affected products (as reported)

Vendor	Product	Versions
nyariv	SandboxJS	< 0.8.29

Weakness: CWE-367 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

https://github.com/nyariv/SandboxJS/security/advisories/GHSA-7x3h-rm86-3342 x_refsource_CONFIRM
https://github.com/nyariv/SandboxJS/commit/67cb186c41c78c51464f70405504e8ef0a6e43c3 x_refsource_MISC
https://github.com/nyariv/SandboxJS/blob/6103d7147c4666fe48cfda58a4d5f37005b43754/src/executor.ts#L304-L304 x_refsource_MISC