Not scored
CVE-2026-25586
SandboxJS has a Sandbox Escape via Prototype Whitelist Bypass and Host Prototype Pollution
nyarivSandboxJS
Status
- Not in CISA KEV
Exploit probabilityEPSSchecked 25 Oct
0.7%probability of exploitation in the next 30 days
Higher than 53% of scored CVEs
SeverityCVSS
–Not scored yet
Description NVD
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, a sandbox escape is possible by shadowing hasOwnProperty on a sandbox object, which disables prototype whitelist enforcement in the property-access path. This permits direct access to proto and other blocked prototype properties, enabling host Object.prototype pollution and persistent cross-sandbox impact. This vulnerability is fixed in 0.8.29.
Coverage 1 article · 1 outlet
- Code Red: 4 Critical SandboxJS Flaws (CVSS 10.0) Allow Host TakeoverSecurityOnline · first in our coverage · mentions it in passing