Is CVE-2026-23830 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-23830 being exploited in the wild.

How severe is CVE-2026-23830?

Low severity, with a CVSS score of 3.1, published 27 January 2026.

Which products and versions are affected?

@nyariv/sandboxjs (npm) SEMVER:introduced=0,fixed=0.8.26; Nyariv Sandboxjs before 0.8.26.

Is there a fix for CVE-2026-23830?

Yes. @nyariv/sandboxjs (npm): upgrade to 0.8.26 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-23830 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-23830?

Check whether you run @nyariv/sandboxjs (npm) or Nyariv Sandboxjs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-23830: SandboxJS sandbox escape via unprotected AsyncFunction constructor

CVE-2026-23830 · Severity: low · CVSS 3.1 · Published 2026-01-27

SandboxJS is a JavaScript library used to safely execute untrusted code in an isolated sandbox environment. A vulnerability in its design allows attackers to bypass the sandbox restrictions by accessing the unprotected AsyncFunction constructor, gaining the ability to execute arbitrary code with full access to the host system. This can lead to complete compromise of any system running SandboxJS to execute user-supplied code.

Technologies: @nyariv/sandboxjs (npm), Nyariv Sandboxjs. Vendors: npm, Nyariv.

Quick answers

Is CVE-2026-23830 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-23830 being exploited in the wild.
How severe is CVE-2026-23830?: Low severity, with a CVSS score of 3.1, published 27 January 2026.
Which products and versions are affected?: @nyariv/sandboxjs (npm) SEMVER:introduced=0,fixed=0.8.26; Nyariv Sandboxjs before 0.8.26.
Is there a fix for CVE-2026-23830?: Yes. @nyariv/sandboxjs (npm): upgrade to 0.8.26 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-23830 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-23830?: Check whether you run @nyariv/sandboxjs (npm) or Nyariv Sandboxjs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@nyariv/sandboxjs (npm): upgrade to 0.8.26 or later
```
npm install @nyariv/sandboxjs@0.8.26
```

Technical details

SandboxJS attempts to prevent code escape by replacing the global Function constructor with a sandboxed version through a mapping in utils.ts. However, the library failed to include mappings for AsyncFunction, GeneratorFunction, and AsyncGeneratorFunction—constructors that are accessible via the .constructor property of function instances. In executor.ts, when the sandboxed code accesses the .constructor property of an async function, the executor returns the native host AsyncFunction constructor instead of a safe replacement. An attacker can exploit this by obtaining the host AsyncFunction constructor and using it to create functions that execute in the global scope outside the sandbox context, achieving remote code execution. The vulnerability affects all versions before 0.8.26 and is fixed in version 0.8.26 and later.

Affected products

nyariv SandboxJS before 0.8.26

Identifiers

CVE-2026-23830
GHSA-wxhw-j4hc-fmq6

Timeline

2026-01-27: disclosed
2026-01-27: advisory
2026-01-27: patched: Version 0.8.26 released

References

https://github.com/nyariv/SandboxJS/security/advisories/GHSA-wxhw-j4hc-fmq6

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.