PT-2026-25822 · Sandboxjs · Sandboxjs

Zwique · Published 2026-03-16 · Updated 2026-03-19 · CVE-2026-32723

Positive Technologies (AI Summary)

CVSS v4.0

4.8

Medium

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions SandboxJS versions prior to 0.8.35

Description SandboxJS, a JavaScript sandboxing library, has an issue where timers can bypass execution quotas. A global tick state (currentTicks.current) is shared between sandboxes. Timer string handlers are compiled at execution time using this global tick state instead of the scheduling sandbox's tick object. In multi-tenant or concurrent sandbox scenarios, another sandbox can overwrite currentTicks.current between scheduling and execution, causing the timer callback to run under a different sandbox's tick budget and bypass the original sandbox's execution quota. This can lead to CPU or resource abuse. The issue is due to the global mutable state shared across all sandbox instances. The currentTicks.current variable is used during timer compilation, and if modified by another sandbox, the timer can execute with an incorrect tick budget. A proof of concept demonstrates that a heavy loop can complete and bypass the quota when another sandbox runs before the timer fires. This impacts applications running multiple SandboxJS instances concurrently, such as multi-tenant interpreters, plugin engines, and server-side scripting hosts.

Recommendations Versions prior to 0.8.35 should be updated to version 0.8.35 or later.

Exploit

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2026-32723

GHSA-7P5M-XRH7-769R

Affected Products

Sandboxjs

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32723.json · Exploit
• https://github.com/nyariv/SandboxJS/commit/cc8f20b4928afed5478d5ad3d1737ef2dcfaac29 · Patch
• https://github.com/nyariv/SandboxJS/security/advisories/GHSA-7p5m-xrh7-769r · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32723 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32723 · Security Note
• https://osv.dev/vulnerability/GHSA-7p5m-xrh7-769r · Vendor Advisory
• https://github.com/nyariv/SandboxJS · Note
• https://twitter.com/VulmonFeeds/status/2034426886281986206 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1rvkawc/resumen_diario_de_vulnerabilidades_16032026 · Reddit Post
• https://twitter.com/CVEnew/status/2034520420926316896 · Twitter Post