CVE-2026-25587: @nyariv/sandboxjs Sandbox Escape Vulnerability
Summary
CVE-2026-25587: @nyariv/sandboxjs has a Sandbox Escape vulnerability. Affects @nyariv/sandboxjs versions < 0.8.29. Fixed in 0.8.29. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @nyariv/sandboxjs package is a JavaScript library designed to create secure sandboxes for executing untrusted code. It provides a controlled environment where potentially harmful scripts can run without affecting the host application. However, a critical vulnerability has been discovered that allows attackers to escape the sandbox and execute arbitrary code, compromising the security of applications using this package.
Vulnerability Detail
The vulnerability arises from the ability to manipulate the prototype of the Map object, which is included in the SAFE_PROTOTYPES of the sandbox. By overwriting the Map.prototype.has method, an attacker can escape the sandbox and execute arbitrary code. This vulnerability is similar to CVE-2026-25142 but is exacerbated by a bug in the 'let' implementation used during testing. The impact of this vulnerability is severe, as it allows for remote code execution (RCE) through the manipulation of built-in JavaScript functions.
How To Fix
Latest published version: 0.9.7 as of 23 Oct 2026
npm install @nyariv/sandboxjs@0.9.7Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.8.29
This is the first release that contains the fix.
npm install @nyariv/sandboxjs@0.8.29Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the Map object within the sandbox or implement additional checks to prevent the overwriting of its prototype methods. However, the best solution is to update to the patched version.
Conclusion
The @nyariv/sandboxjs package has a critical vulnerability that allows for sandbox escape and remote code execution. It is essential to update to the latest version to mitigate this risk. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for @nyariv/sandboxjs →
FAQ
The CVSS score of this vulnerability is 10.0, indicating a critical severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
If exploited, this vulnerability can lead to remote code execution, allowing attackers to run arbitrary code within the application, potentially compromising sensitive data and system integrity.
Yes, version 0.8.29 and later of @nyariv/sandboxjs has been patched to address this vulnerability.
If immediate updates are not possible, consider implementing workarounds such as avoiding the use of the Map object in the sandbox or adding checks to prevent prototype manipulation.
References
Related vulnerabilities
Recent vulnerabilities recorded for @nyariv/sandboxjs.
