Executive brief
SandboxJS is a JavaScript sandbox library designed to safely execute untrusted code in isolation. A critical vulnerability in prototype access controls allows attackers to bypass sandbox restrictions and execute arbitrary code on the system, leading to complete system compromise through remote code execution.
Technical details
SandboxJS fails to properly restrict access to the __lookupGetter__ method, which can be used to obtain Object prototypes and bypass sandbox isolation. The vulnerability exists in the function property access code path (executor.ts lines 368-398), where a special case for functions bypasses prototype chain whitelist checks that normally protect the root Object prototype. An unauthenticated attacker can inject a payload that uses __lookupGetter__ to access the forbidden __proto__ property, allowing them to escape the sandbox and execute arbitrary Node.js code via child_process.execSync(). The fix is available in version 0.8.27; all versions prior to 0.8.26 are affected.
Affected products
- nyariv SandboxJS <= 0.8.26
Timeline
- 2026-02-02: disclosed: GHSA-9p4w-fq8m-2hp7 and CVE-2026-25142 published
- 2026-02-02: patched: Fix released in version 0.8.27