Executive brief
SandboxJS is a JavaScript sandbox library used to safely execute untrusted code in isolated environments. A critical vulnerability allows attackers to escape the sandbox and execute arbitrary code on the host system by exploiting improper restrictions on access to built-in JavaScript functions like Object.entries() and Object.values().
Technical details
The vulnerability is a code injection (CWE-94) flaw in SandboxJS's sandbox isolation mechanism. An attacker can obtain arrays containing the Function constructor through methods like Object.entries(this).at(1) or Object.values(this).slice(1, 2), then use Object.fromEntries() to construct objects with arbitrary properties mapped to Function. This allows execution of arbitrary code via promise-based gadget chains (e.g., .finally() with code strings). The attack requires no authentication or user interaction and is network-accessible. The vulnerability affects all versions up to and including 0.8.33 and is patched in version 0.8.34.
Affected products
- nyariv SandboxJS <= 0.8.33
Timeline
- 2026-03-13: disclosed
- 2026-03-13: patched: version 0.8.34