CVE-2026-34208: SandboxJS Critical Sandbox Integrity Escape Vulnerability
Summary
CVE-2026-34208: SandboxJS: Sandbox integrity escape. Affects @nyariv/sandboxjs versions < 0.8.36. Fixed in 0.8.36. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SandboxJS is a JavaScript library designed to create secure execution environments for untrusted code. It allows developers to run potentially harmful scripts in a controlled manner, preventing them from accessing sensitive data or executing malicious actions. However, a critical vulnerability has been discovered that allows attackers to bypass the library's protections and manipulate global objects, undermining the intended security model.
Vulnerability Detail
The vulnerability arises from the ability to bypass SandboxJS's restrictions on global object assignments. Although direct assignments to global objects are blocked, attackers can exploit a callable constructor path to write arbitrary properties into host global objects. This is achieved through the this.constructor.call(target, attackerObject) method, allowing malicious code to persistently mutate global objects across sandbox instances. The implications are severe, as it enables untrusted code to alter built-in JavaScript functionalities, leading to potential security breaches and data manipulation.
How To Fix
Latest published version: 0.9.7 as of 23 Oct 2026
npm install @nyariv/sandboxjs@0.9.7Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.8.36
This is the first release that contains the fix.
npm install @nyariv/sandboxjs@0.8.36Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the vulnerable features of SandboxJS until you can update to the patched version. Additionally, you can implement strict validation of any code that runs within the sandbox to minimize the risk of exploitation.
Conclusion
The CVE-2026-34208 vulnerability in SandboxJS poses a significant risk by allowing untrusted code to manipulate global objects. It is crucial for developers using this library to update to the patched version 0.8.36 to protect their applications from potential exploitation. Utilizing tools like Vulert can further enhance security by monitoring for vulnerabilities in real-time.
See every vulnerability recorded for @nyariv/sandboxjs →
FAQ
CVE-2026-34208 is a critical vulnerability in the SandboxJS library that allows attackers to bypass security measures and manipulate global objects.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can lead to unauthorized modifications of global objects, which may result in data manipulation, security breaches, and compromised application integrity.
Yes, a patch is available in version 0.8.36 of the @nyariv/sandboxjs package. It is recommended to update to this version to mitigate the risk.
Vulert is a monitoring tool that uses package-lock.json to track open-source vulnerabilities in your software. It provides real-time alerts for vulnerabilities, helping you maintain secure applications.
References
Related vulnerabilities
Recent vulnerabilities recorded for @nyariv/sandboxjs.
