Vendor
nyariv
- CVEs tracked · all time
- 6
- in CISA KEV · all time
- 0
- articles · since 11 Sep
- 0
- articles · all time
- 3
No articles in the last 45 daysThe latest: SecurityOnline, Wed 11 Feb, 01:15 UTC.See the full timeline
Products: SandboxJS
CVEs
6 CVEsCVE-2026-25881@nyariv/sandboxjs has host prototype pollution from sandbox via array intermediary (sandbox escape)CVSSUnrated–Not in KEV0.6%EPSS1article
CVE-2026-25641SandboxJS has a sandbox escape via TOCTOU bug on keys in property accessesCVSSUnrated–Not in KEV0.5%EPSS1article
CVE-2026-25586SandboxJS has a Sandbox Escape via Prototype Whitelist Bypass and Host Prototype PollutionCVSSUnrated–Not in KEV0.7%EPSS1article
CVE-2026-23830SandboxJS has Sandbox Escape via Unprotected AsyncFunction ConstructorCVSSUnrated–Not in KEV1.2%EPSS1article
- Sandbox Breakout: Critical SandboxJS Flaw (CVE-2026-25881) Allows Host TakeoverSecurityOnline
- Code Red: 4 Critical SandboxJS Flaws (CVSS 10.0) Allow Host TakeoverSecurityOnline
- CVE-2026-23830: Critical SandboxJS Flaw (CVSS 10) Allows Total Sandbox EscapeSecurityOnline · first in our coverage