PT-2026-5727 · Sandboxjs · Sandboxjs

C0Rydoras · Published 2026-02-02 · Updated 2026-02-03 · CVE-2026-25142

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SandboxJS versions prior to 0.8.27

Description SandboxJS is a JavaScript sandboxing library with an issue where the lookupGetter function is not properly restricted. This can allow obtaining prototypes, potentially leading to sandbox escape and remote code execution. The issue affects versions prior to 0.8.27.

Recommendations Update to SandboxJS version 0.8.27 or later.

Exploit

Fix

Code Injection

Prototype Pollution

Weakness Enumeration

CWE-94

CWE-1321

Related Identifiers

CVE-2026-25142

GHSA-9P4W-FQ8M-2HP7

Affected Products

Sandboxjs

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25142.json · Exploit
• https://github.com/nyariv/SandboxJS/security/advisories/GHSA-9p4w-fq8m-2hp7 · Vendor Advisory
• https://github.com/nyariv/SandboxJS/commit/75c8009db32e6829b0ad92ca13bf458178442bd3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-25142 · Security Note
• https://osv.dev/vulnerability/GHSA-9p4w-fq8m-2hp7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25142 · Vendor Advisory
• https://github.com/nyariv/SandboxJS · Note
• https://github.com/nyariv/SandboxJS/blob/f212a38fb5a6d4bc2bc2e2466c0c011ce8d41072/src/executor.ts#L368-L398 · Note
• https://twitter.com/CVEnew/status/2018465508035620976 · Twitter Post
• https://twitter.com/0dayPublishing/status/2018462421459902846 · Twitter Post
• https://twitter.com/CveFindCom/status/2018477359226110273 · Twitter Post