PT-2026-5036 · Sandboxjs · Sandboxjs

Nyxsorcerer · Published 2026-01-27 · Updated 2026-03-07 · CVE-2026-23830

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SandboxJS versions prior to 0.8.26

Description SandboxJS, a JavaScript sandboxing library, has a flaw where the AsyncFunction constructor is not properly isolated within the SandboxFunction. The library aims to secure code execution by replacing the global Function constructor with a sandboxed version. However, prior to version 0.8.26, mappings for AsyncFunction, GeneratorFunction, and AsyncGeneratorFunction were missing. This allows code within the sandbox to access the native host AsyncFunction constructor via the .constructor property of an async function. By obtaining this constructor, an attacker can create and execute functions outside the sandbox, leading to Remote Code Execution (RCE). The vulnerability is due to the failure to intercept the AsyncFunction constructor, allowing attackers to bypass security restrictions and gain full access to the host environment.

Recommendations Versions prior to 0.8.26 should be updated to version 0.8.26 or later.

Exploit

Fix

RCE

Protection Mechanism Failure

Code Injection

Weakness Enumeration

CWE-913

CWE-693

CWE-94

Related Identifiers

CVE-2026-23830

GHSA-WXHW-J4HC-FMQ6

Affected Products

Sandboxjs

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23830.json · Exploit
• https://github.com/nyariv/SandboxJS/security/advisories/GHSA-wxhw-j4hc-fmq6 · Vendor Advisory
• https://github.com/nyariv/SandboxJS/commit/345aee6566e47979dee5c337b925b141e7f78ccd · Patch
• https://osv.dev/vulnerability/GHSA-wxhw-j4hc-fmq6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23830 · Security Note
• https://osv.dev/vulnerability/CVE-2026-23830 · Vendor Advisory
• https://github.com/nyariv/SandboxJS · Note
• https://twitter.com/pulsepatchio/status/2016524113461023050 · Twitter Post
• https://twitter.com/zerodaywire/status/2016908343835562035 · Twitter Post
• https://twitter.com/0dayPublishing/status/2016295485300998507 · Twitter Post
• https://twitter.com/_cvereports/status/2016242472142192943 · Twitter Post
• https://twitter.com/cracbot/status/2018278269083337213 · Twitter Post
• https://twitter.com/Komodosec/status/2030359381293113744 · Twitter Post
• https://t.me/pentestingnews/72709 · Telegram Post
• https://twitter.com/CVEnew/status/2016296314083197026 · Twitter Post