Executive brief
SandboxJS is a JavaScript sandbox library designed to safely execute untrusted code. The parser contains unbounded recursion that can be triggered by deeply nested expressions (e.g., thousands of nested parentheses), causing the Node.js process to crash with a stack overflow error. An attacker can crash any application using this library with a trivial, unauthenticated input.
Technical details
The vulnerability is an uncontrolled recursion flaw (CWE-674) in the recursive descent parser. Two code paths are vulnerable: (1) the restOfExp function in src/parser.ts lacks depth tracking and recursively calls itself for each nested bracket without limit; (2) the lispify→lispifyExpr call chain similarly processes nested groups with no recursion depth check. The parser accepts user input directly from all public API methods (Sandbox.parse(), Sandbox.compile(), compileExpression(), etc.) with no depth validation. An attacker supplies deeply nested expressions (approximately 2000+ levels) to trigger RangeError: Maximum call stack size exceeded. In Node.js, this exception is not catchable in the normal sense and crashes the entire process, making this a denial-of-service vector. The fix requires adding a depth parameter to both recursive chains with a maximum depth check (suggested: 256) that throws a ParseError when exceeded. Patched in version 0.8.36.
Affected products
- nyariv SandboxJS <= 0.8.35
Timeline
- 2026-04-03: disclosed
- 2026-04-03: patched: Version 0.8.36 released