Critical Sandbox Escape Vulnerability in @nyariv/sandboxjs
Summary
GHSA-wxhw-j4hc-fmq6: SandboxJS has Sandbox Escape via Unprotected AsyncFunction Constructor. Affects @nyariv/sandboxjs versions < 0.8.26. Fixed in 0.8.26. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @nyariv/sandboxjs package is designed to provide a secure environment for executing JavaScript code by sandboxing the execution context. It replaces the global Function constructor with a safe version to prevent unauthorized access to the host environment. However, it has a critical vulnerability that allows attackers to escape the sandbox and execute arbitrary code in the host environment.
Vulnerability Detail
The vulnerability arises from the lack of mappings for AsyncFunction, GeneratorFunction, and AsyncGeneratorFunction in the sandboxing mechanism. When an async function is created within the sandbox, accessing its .constructor property retrieves the native AsyncFunction constructor instead of the sandboxed version. This allows attackers to create functions that execute outside the sandbox, leading to Remote Code Execution (RCE) and full access to the host environment.
How To Fix
Latest published version: 0.9.7 as of 23 Oct 2026
npm install @nyariv/sandboxjs@0.9.7Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.8.26
This is the first release that contains the fix.
npm install @nyariv/sandboxjs@0.8.26Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using async functions within the sandbox until the package is updated. If you must use async functions, consider implementing additional security measures to validate and sanitize the code being executed.
Conclusion
The @nyariv/sandboxjs package has a critical vulnerability that allows sandbox escape through unprotected AsyncFunction constructors. It is essential to update to version 0.8.26 or later to secure your application. Utilize tools like Vulert for real-time monitoring of open-source vulnerabilities.
See every vulnerability recorded for @nyariv/sandboxjs →
FAQ
The CVSS score of this vulnerability is 10.0, indicating a critical severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
An attacker exploiting this vulnerability can execute arbitrary code in the host environment, leading to severe security breaches and data compromise.
Yes, avoid using async functions in the sandbox and implement additional security measures to validate the code being executed.
If immediate updates are not possible, consider isolating the affected application from sensitive data and monitoring for any suspicious activity.
References
Related vulnerabilities
Recent vulnerabilities recorded for @nyariv/sandboxjs.
