Not scored
CVE-2026-25587
SandboxJS has a Sandbox Escape
nyarivSandboxJS
Status
- Not in CISA KEV
Exploit probabilityEPSSchecked 25 Oct
0.7%probability of exploitation in the next 30 days
Higher than 53% of scored CVEs
SeverityCVSS
–Not scored yet
Description NVD
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, as Map is in SAFE_PROTOYPES, it's prototype can be obtained via Map.prototype. By overwriting Map.prototype.has the sandbox can be escaped. This vulnerability is fixed in 0.8.29.
Coverage 1 article · 1 outlet
- Code Red: 4 Critical SandboxJS Flaws (CVSS 10.0) Allow Host TakeoverSecurityOnline · first in our coverage · mentions it in passing