PT-2026-25322 · Sandboxjs · Sandboxjs

C0Rydoras

·

Published

2026-03-13

·

Updated

2026-03-17

·

CVE-2026-26954

CVSS v3.1

10

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions SandboxJS versions prior to 0.8.34
Description SandboxJS is a JavaScript sandboxing library susceptible to a sandbox escape. The issue arises from the ability to obtain arrays containing the Function constructor. Combined with Object.fromEntries, this allows constructing objects with properties that can execute arbitrary code, leading to a complete escape of the sandbox. The provided Proof of Concept (PoC) demonstrates the exploitation of this issue using process.getBuiltinModule("child process").execSync("ls", {stdio: "inherit"}) to execute system commands. The vulnerability can result in Remote Code Execution (RCE). The API endpoint is not explicitly mentioned. The vulnerable variable is Function.
Recommendations Versions prior to 0.8.34 should be updated to version 0.8.34 or later.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2026-04459
CVE-2026-26954
GHSA-6R9F-759J-HJGV

Affected Products

Sandboxjs