PT-2026-6653 · Sandboxjs · Sandboxjs

C0Rydoras

·

Published

2026-02-05

·

Updated

2026-02-09

·

CVE-2026-25587

CVSS v3.1

10

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions SandboxJS versions prior to 0.8.29
Description SandboxJS is a JavaScript sandboxing library. Prior to version 0.8.29, a flaw exists where the prototype of the Map object, present in SAFE PROTOYPES, can be accessed via Map.prototype. By overwriting the Map.prototype.has function, the sandbox can be escaped, potentially leading to remote code execution. The issue stems from a bug in the let implementation, where using let instead of const to declare a variable referencing Map.prototype results in undefined. This allows manipulation of the Map.prototype.has function. A proof-of-concept (PoC) demonstrates the ability to execute arbitrary commands, such as listing directory contents, by redefining Map.prototype.has to call isFinite.constructor with a malicious string.
Recommendations Versions prior to 0.8.29 should be updated to version 0.8.29 to address this issue.

Exploit

Fix

Code Injection

Special Elements Injection

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

CVE-2026-25587
GHSA-66H4-QJ4X-38XP

Affected Products

Sandboxjs