CVE-2026-25586: @nyariv/sandboxjs Critical Sandbox Escape via Prototype Whitelist Bypass
Summary
CVE-2026-25586: @nyariv/sandboxjs has Sandbox Escape via Prototype Whitelist Bypass and Host Prototype Pollution. Affects @nyariv/sandboxjs versions < 0.8.29. Fixed in 0.8.29. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @nyariv/sandboxjs package is a JavaScript library designed to create secure execution environments (sandboxes) for running untrusted code. It allows developers to safely execute code while restricting access to the host environment, thus preventing malicious actions. However, a critical vulnerability has been identified that allows attackers to bypass these restrictions, leading to potential host prototype pollution and security breaches.
Vulnerability Detail
The vulnerability arises from the improper handling of the 'hasOwnProperty' method on sandboxed objects. By shadowing this method, an attacker can disable prototype whitelist enforcement, allowing access to restricted prototype properties such as 'proto'. This can lead to host Object.prototype pollution, enabling attackers to manipulate the host environment and execute arbitrary code. The issue is particularly severe as it can result in persistent cross-sandbox impacts and denial of service (DoS) attacks.
How To Fix
Latest published version: 0.9.7 as of 23 Oct 2026
npm install @nyariv/sandboxjs@0.9.7Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.8.29
This is the first release that contains the fix.
npm install @nyariv/sandboxjs@0.8.29Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the default configuration of the Sandbox and implement custom globals or whitelists to limit the attack surface. However, this is not a complete solution and upgrading to the patched version is strongly recommended.
Conclusion
The vulnerability identified in @nyariv/sandboxjs poses a significant risk due to its potential for sandbox escape and host prototype pollution. It is crucial for developers using this package to update to the latest version to safeguard their applications against exploitation. Utilizing tools like Vulert can help in monitoring and managing open-source vulnerabilities effectively.
See every vulnerability recorded for @nyariv/sandboxjs →
FAQ
The CVSS score of this vulnerability is 10.0, indicating a critical severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without any signup.
The vulnerability can lead to host prototype pollution, allowing attackers to manipulate the host environment, execute arbitrary code, and potentially cause denial of service.
While a complete fix requires updating to the patched version, you can temporarily limit exposure by implementing custom globals or whitelists in the Sandbox configuration.
If immediate updating is not possible, ensure that your application is not exposed to untrusted code execution and consider implementing additional security measures to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for @nyariv/sandboxjs.
