CVE-2026-43898: nyariv SandboxJS sandbox escape via Function.caller leakage

Executive brief

SandboxJS is a library used to execute untrusted JavaScript code in a restricted environment. A vulnerability allows an attacker to bypass these restrictions and execute arbitrary commands on the underlying server or host system. This could lead to full system compromise, unauthorized data access, or complete service disruption.

Technical details

A sandbox escape exists in SandboxJS due to the exposure of 'Function.caller' in sandboxed functions, particularly in CommonJS builds. This allows sandboxed code to leak the internal 'LispType.Call' runtime callback. Because the 'LispType.Call' handler in 'call.ts' fails to authenticate the 'params' object, an attacker can invoke it with forged operands. This enables the extraction of blocked host statics and the recovery of the host's Function constructor, leading to arbitrary JavaScript execution in the host context. The issue is patched in version 0.9.6.

Affected products

• nyariv @nyariv/sandboxjs <= 0.9.5

Timeline

• 2026-05-09: disclosed
• 2026-05-11: advisory
• 2026-05-11: patched: Version 0.9.6 released

References

• https://api.github.com/users/Macabely
• https://github.com/Macabely
• https://api.github.com/users/Macabely/gists%7B/gist_id%7D
• https://api.github.com/users/Macabely/repos
• https://avatars.githubusercontent.com/u/172206083?v=4
• https://api.github.com/users/Macabely/events%7B/privacy%7D