CVE-2026-34217: SandboxJS sandbox escape via Prop object leak in new handler

CVE-2026-34217 · Severity: high · CVSS 7.2 · Published 2026-04-06

SandboxJS is a JavaScript sandbox library that restricts untrusted code execution by intercepting object construction and function calls. A vulnerability in versions 0.8.35 and below allows sandboxed code to leak internal interpreter objects and access the host's global scope, potentially enabling modification of sandbox scope variables. While code evaluation remains isolated, this breaks the security boundary that prevents sandboxed code from accessing protected objects like the real Function constructor and eval.

Technologies: @nyariv/sandboxjs (npm), Nyariv Sandboxjs. Vendors: npm, Nyariv.

Quick answers

Is CVE-2026-34217 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-34217 being exploited in the wild.
How severe is CVE-2026-34217?
High severity, with a CVSS score of 7.2, published 6 April 2026.
Which products and versions are affected?
@nyariv/sandboxjs (npm) SEMVER:introduced=0,fixed=0.8.36; Nyariv Sandboxjs 0.8.35 and below.
Is there a fix for CVE-2026-34217?
Yes. @nyariv/sandboxjs (npm): upgrade to 0.8.36 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34217 attacked?
It is attacked over the network.
Am I affected by CVE-2026-34217?
Check whether you run @nyariv/sandboxjs (npm) or Nyariv Sandboxjs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @nyariv/sandboxjs (npm): upgrade to 0.8.36 or later
    npm install @nyariv/sandboxjs@0.8.36

Technical details

The vulnerability is a scope modification flaw in the new operator handler (src/executor.ts lines 1275–1280) that fails to sanitize constructor arguments and return values. The handler passes raw Prop objects (internal wrappers containing references to scope.allVars) directly to constructors without calling valueOrProp(), and returns constructed objects without sanitization via getGlobalProp() or sanitizeArray(). When sandboxed code executes `new Constructor(someVariable)`, a malicious constructor can access the Prop's `context` field, obtaining a direct reference to scope.allVars (which contains the real host globalThis, Function, eval, and other globals). The attack requires only that the host application runs sandboxed code and reads its return value, with no authentication or user interaction needed. A fix is available in version 0.8.36 that adds proper argument and return value sanitization matching the Call handler's implementation.

Affected products

  • nyariv SandboxJS 0.8.35 and below

Identifiers

  • CVE-2026-34217
  • GHSA-hg73-4w7g-q96w

Timeline

  • 2026-04-03: disclosed
  • 2026-04-03: patched: Version 0.8.36 patches the vulnerability

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.