Executive brief
@nyariv/sandboxjs is a JavaScript sandbox environment that isolates untrusted code execution. A vulnerability in how the sandbox validates property access keys allows attackers to bypass security checks through object coercion, leading to remote code execution and complete compromise of the sandboxed environment.
Technical details
The vulnerability is a time-of-check-to-time-of-use (TOCTOU) bug in the property access handler (executor.ts line 304). Although the key parameter is annotated as string, the code does not enforce string type coercion, allowing attackers to pass malicious objects with custom toString() methods. These objects can return different string values at different call times—e.g., "x" when checked with hasOwnProperty() but "__proto__" when used for actual property access. An attacker with code execution inside the sandbox can exploit this to access the __proto__ property and modify critical functions like isFinite.constructor, enabling arbitrary code execution. The vulnerability affects versions <= 0.8.28 and is patched in 0.8.29.
Affected products
- nyariv @nyariv/sandboxjs <= 0.8.28
Timeline
- 2026-02-05: disclosed
- 2026-02-05: patched: Fixed in version 0.8.29