PT-2025-31547 · Unknown · @Nyariv/Sandboxjs

Hagrid29 · Published 2025-07-31 · Updated 2025-07-31 · CVE-2025-34146

Positive Technologies (AI Summary)

CVSS v4.0

7.0

High

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions @nyariv/sandboxjs versions through 0.8.23

Description A prototype pollution issue exists in @nyariv/sandboxjs, allowing attackers to inject arbitrary properties into Object.prototype via crafted JavaScript code. This can lead to a denial-of-service (DoS) condition or, potentially, escape the sandboxed environment. The root cause is insufficient prototype access checks within the sandbox’s executor logic, specifically when handling JavaScript function objects returned.

Recommendations Update @nyariv/sandboxjs to a version later than 0.8.23.

Exploit

Fix

DoS

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2025-34146

GHSA-9QM3-6QRR-C76M

Affected Products

@Nyariv/Sandboxjs

References · 10

• 🔥 https://gist.github.com/Hagrid29/9df27829a491080f923c4f6b8518d7e3 · Exploit
• https://osv.dev/vulnerability/GHSA-9qm3-6qrr-c76m · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-34146 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-34146 · Security Note
• https://github.com/nyariv/SandboxJS · Note
• https://github.com/nyariv/SandboxJS/issues/31 · Patch, Vendor Advisory
• https://t.me/CVEtracker/28861 · Telegram Post
• https://vulncheck.com/advisories/nyariv-sandboxjs-prototype-pollution-sandbox-escape-dos · Note
• https://npmjs.com/package/@nyariv/sandboxjs · Note
• https://twitter.com/CVEnew/status/1950939106818830694 · Twitter Post