Quick answers
- Is CVE-2026-25641 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-25641 being exploited in the wild.
- How severe is CVE-2026-25641?
- Low severity, with a CVSS score of 3.1, published 5 February 2026.
- Which products and versions are affected?
- @nyariv/sandboxjs (npm) SEMVER:introduced=0,fixed=0.8.29.
- Is there a fix for CVE-2026-25641?
- Yes. @nyariv/sandboxjs (npm): upgrade to 0.8.29 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-25641 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-25641?
- Check whether you run @nyariv/sandboxjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- @nyariv/sandboxjs (npm): upgrade to 0.8.29 or later
npm install @nyariv/sandboxjs@0.8.29
Technical details
The vulnerability is a time-of-check-to-time-of-use (TOCTOU) bug in the property access handler (executor.ts line 304). Although the key parameter is annotated as string, the code does not enforce string type coercion, allowing attackers to pass malicious objects with custom toString() methods. These objects can return different string values at different call times—e.g., "x" when checked with hasOwnProperty() but "__proto__" when used for actual property access. An attacker with code execution inside the sandbox can exploit this to access the __proto__ property and modify critical functions like isFinite.constructor, enabling arbitrary code execution. The vulnerability affects versions <= 0.8.28 and is patched in 0.8.29.
Affected products
- nyariv @nyariv/sandboxjs <= 0.8.28
Identifiers
- CVE-2026-25641
- GHSA-7x3h-rm86-3342
Timeline
- 2026-02-05: disclosed
- 2026-02-05: patched: Fixed in version 0.8.29