PT-2026-6658 · Sandboxjs · Sandboxjs

Cristianstaicu · Published 2026-02-05 · Updated 2026-02-09 · CVE-2026-25641

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SandboxJS versions prior to 0.8.29

Description SandboxJS, a JavaScript sandboxing library, has a sandbox escape issue. This is due to a mismatch between the key used for validation and the key used for property access. The key, intended to be a string, is not enforced as such, allowing attackers to use malicious objects that change string values during sanitization and property access. This could lead to remote code execution if an attacker can execute code within the sandbox.

Recommendations Versions prior to 0.8.29 should be updated to version 0.8.29.

Exploit

Fix

Time Of Check To Time Of Use

Special Elements Injection

Weakness Enumeration

CWE-367

CWE-74

Related Identifiers

CVE-2026-25641

GHSA-7X3H-RM86-3342

Affected Products

Sandboxjs

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25641.json · Exploit
• 🔥 https://github.com/nyariv/SandboxJS/security/advisories/GHSA-7x3h-rm86-3342 · Exploit
• https://github.com/nyariv/SandboxJS/commit/67cb186c41c78c51464f70405504e8ef0a6e43c3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-25641 · Security Note
• https://osv.dev/vulnerability/GHSA-7x3h-rm86-3342 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25641 · Vendor Advisory
• https://github.com/nyariv/SandboxJS · Note
• https://github.com/nyariv/SandboxJS/blob/6103d7147c4666fe48cfda58a4d5f37005b43754/src/executor.ts#L304-L304 · Note
• https://t.me/CVEtracker/43963 · Telegram Post
• https://twitter.com/PurpleOps_io/status/2020709488693477585 · Twitter Post
• https://twitter.com/ksg93rd/status/2020534817331273841 · Twitter Post
• https://twitter.com/CVEnew/status/2019876703460552996 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1qxjol3/resumen_diario_de_vulnerabilidades_06022026 · Reddit Post
• https://twitter.com/CveFindCom/status/2019896606338756715 · Twitter Post
• https://twitter.com/TheHackerWire/status/2019867920604754062 · Twitter Post