CVE-2026-43898: Critical Sandbox Escape in @nyariv/sandboxjs via Function.caller Leakage
Summary
CVE-2026-43898: SandboxJS has a sandbox escape via Function.caller leakage of internal call op. Affects @nyariv/sandboxjs versions < 0.9.6. Fixed in 0.9.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
SandboxJS is a JavaScript library designed to create a secure execution environment for running untrusted code. It allows developers to run potentially harmful scripts in a controlled manner, isolating them from the host environment. However, a critical vulnerability has been discovered that allows attackers to escape the sandbox and execute arbitrary JavaScript code in the host environment, compromising the security model of the library.
Vulnerability Detail
The vulnerability arises from the exposure of the Function.caller property in sandbox-defined functions, which allows sandboxed code to access the internal LispType.Call runtime callback. This callback can be invoked with attacker-controlled parameters, enabling the extraction of sensitive host information and the execution of arbitrary host JavaScript. The lack of authentication checks on the parameters passed to the callback allows attackers to manipulate the execution context, leading to a complete sandbox escape and potential remote code execution (RCE).
How To Fix
Latest published version: 0.9.7 as of 23 Oct 2026
npm install @nyariv/sandboxjs@0.9.7Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.9.6
This is the first release that contains the fix.
npm install @nyariv/sandboxjs@0.9.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the sandboxed functions that expose the Function.caller property until you can update to the patched version. Additionally, consider implementing stricter input validation and sanitization for any data passed to the sandboxed environment.
Conclusion
CVE-2026-43898 represents a critical vulnerability in the @nyariv/sandboxjs package that allows for sandbox escape and remote code execution. It is essential for developers using this library to update to version 0.9.6 or later to mitigate the risk. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for @nyariv/sandboxjs →
FAQ
The impact of this vulnerability is critical, as it allows attackers to escape the sandbox and execute arbitrary code in the host environment, potentially leading to data breaches and system compromise.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By analyzing your package-lock.json file, Vulert can help you identify if your application is affected by this vulnerability.
If you cannot update the package right away, implement stricter input validation and avoid using the vulnerable sandboxed functions until you can apply the patch.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup or installation.
The CVSS score for CVE-2026-43898 is 10.0, indicating a critical severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for @nyariv/sandboxjs.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
