PT-2026-30274 · Sandboxjs · Sandboxjs

Chawdamrunal

·

Published

2026-04-03

·

Updated

2026-04-06

·

CVE-2026-34217

CVSS v3.1

7.2

High

VectorAV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions SandboxJS versions prior to 0.8.36
Description A scope modification vulnerability exists in SandboxJS, specifically in versions 0.8.35 and below. Untrusted sandboxed code can leak internal interpreter objects through the new operator, exposing sandbox scope objects to untrusted code. While code evaluation and prototypes remain protected, this allows modification of scopes within the sandbox. The root cause is missing sanitization steps in the New operator handler within the src/executor.ts file (lines 1275–1280). Specifically, constructor arguments are not sanitized using valueOrProp(), and the return value is not sanitized using getGlobalProp() or sanitizeArray(). This contrasts with the Call handler, which correctly sanitizes both arguments and return values. The vulnerability allows an attacker to access real host JavaScript objects, such as globalThis, Function, and eval, through a Prop object, and then store a reference to the sandbox's scope within a constructed object. A proof of concept demonstrates the ability to leak the scope object by creating a constructor that captures the isNaN object's context. The attack requires no authentication or user interaction and works with the default sandbox configuration.
Recommendations Update to SandboxJS version 0.8.36 or later to address the vulnerability. As a critical fix, sanitize constructor arguments in the New operator handler by adding valueOrProp() to the arguments array. Implement deep sanitization of sandbox return values to strip internal references. Freeze or seal the options.globals and scope.allVars objects after construction to prevent mutation.

Exploit

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

CVE-2026-34217
GHSA-HG73-4W7G-Q96W

Affected Products

Sandboxjs