PT-2026-7165 · Sandboxjs · Sandboxjs

K14Uz · Published 2026-02-09 · Updated 2026-03-20 · CVE-2026-25881

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SandboxJS versions prior to 0.8.31

Description SandboxJS is a JavaScript sandboxing library with a flaw that allows sandboxed code to modify host built-in prototypes. This is achieved by removing a protection flag through array literal intermediaries, enabling direct prototype mutation from within the sandbox. This prototype pollution can lead to remote code execution in applications that utilize these polluted properties in sensitive operations, such as using execSync(obj.cmd). The issue stems from the improper handling of the isGlobal taint flag when retrieving global prototype references from arrays.

Recommendations Update SandboxJS to version 0.8.31 or later.

Exploit

Fix

RCE

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

BDU:2026-05058

CVE-2026-25881

GHSA-WW7G-4GWX-M7WJ

Affected Products

Sandboxjs

References · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25881.json · Exploit
• https://github.com/nyariv/SandboxJS/security/advisories/GHSA-ww7g-4gwx-m7wj · Vendor Advisory
• https://github.com/nyariv/SandboxJS/commit/f369f8db26649f212a6a9a2e7a1624cb2f705b53 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-25881 · Security Note
• https://osv.dev/vulnerability/GHSA-ww7g-4gwx-m7wj · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05058 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25881 · Vendor Advisory
• https://github.com/nyariv/SandboxJS · Note
• https://twitter.com/CCBalert/status/2021248115374735394 · Twitter Post
• https://twitter.com/CVEnew/status/2020982063050936662 · Twitter Post
• https://twitter.com/dailytechonx/status/2021993576247201960 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1r1w0bk/resumen_diario_de_vulnerabilidades_11022026 · Reddit Post
• https://t.me/pentestingnews/73041 · Telegram Post
• https://twitter.com/pulsepatchio/status/2021240588235079893 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1r1vyjc/resumen_diario_de_vulnerabilidades_11022026 · Reddit Post