CVE-2026-25641: @nyariv/sandboxjs Critical Sandbox Escape Vulnerability
Summary
CVE-2026-25641: @nyariv/sandboxjs vulnerable to sandbox escape via TOCTOU bug on keys in property accesses. Affects @nyariv/sandboxjs versions < 0.8.29. Fixed in 0.8.29. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @nyariv/sandboxjs package is a JavaScript library that allows developers to execute code in a controlled environment, or sandbox, to prevent malicious actions. It is designed to provide a secure way to run untrusted code while limiting access to sensitive resources. However, a critical vulnerability has been identified that allows attackers to escape the sandbox, potentially leading to remote code execution.
Vulnerability Detail
The vulnerability arises from a Time-of-Check to Time-of-Use (TOCTOU) bug in property accesses. The key used for validation does not match the key used for accessing properties, allowing attackers to exploit this inconsistency. By passing malicious objects that can coerce to different string values, an attacker can manipulate the behavior of the sandbox, leading to unauthorized access and execution of arbitrary code. This poses a significant risk, as it can lead to remote code execution if an attacker can run code inside the sandbox.
How To Fix
Minimum fixed version
0.8.29
This is the first release that contains the fix.
npm install @nyariv/sandboxjs@0.8.29Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the sandbox environment for executing untrusted code until you can update to the patched version. Additionally, ensure that any objects passed to the sandbox are sanitized and do not have properties that can be coerced into different values.
Conclusion
The @nyariv/sandboxjs package has a critical vulnerability that allows for sandbox escape due to a TOCTOU bug. It is essential to update to the patched version 0.8.29 to secure your application against potential remote code execution attacks. Utilize tools like Vulert to monitor for vulnerabilities in your projects.
See every vulnerability recorded for @nyariv/sandboxjs →
FAQ
The vulnerability has a CVSS score of 10.0, indicating it is critical and poses a significant risk to applications using the affected package.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
If exploited, this vulnerability can lead to remote code execution, allowing attackers to run arbitrary code within the sandbox environment, which can compromise the entire application.
Yes, a patch is available in version 0.8.29 of the @nyariv/sandboxjs package. It is recommended to update to this version to mitigate the risk.
If you cannot update the package right away, consider implementing a workaround by avoiding the use of the sandbox for untrusted code execution and ensuring that any objects passed to it are properly sanitized.
References
Related vulnerabilities
Recent vulnerabilities recorded for @nyariv/sandboxjs.
