PT-2026-6653 · Sandboxjs · Sandboxjs
C0Rydoras
·
Published
2026-02-05
·
Updated
2026-02-09
·
CVE-2026-25587
CVSS v3.1
10
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
SandboxJS versions prior to 0.8.29
Description
SandboxJS is a JavaScript sandboxing library. Prior to version 0.8.29, a flaw exists where the prototype of the
Map object, present in SAFE PROTOYPES, can be accessed via Map.prototype. By overwriting the Map.prototype.has function, the sandbox can be escaped, potentially leading to remote code execution. The issue stems from a bug in the let implementation, where using let instead of const to declare a variable referencing Map.prototype results in undefined. This allows manipulation of the Map.prototype.has function. A proof-of-concept (PoC) demonstrates the ability to execute arbitrary commands, such as listing directory contents, by redefining Map.prototype.has to call isFinite.constructor with a malicious string.Recommendations
Versions prior to 0.8.29 should be updated to version 0.8.29 to address this issue.
Exploit
Fix
Code Injection
Special Elements Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Sandboxjs