# CVE-2026-53676: ThingsBoard prototype pollution sandbox escape in JS executor

Source: https://junglewise.ai/threats/cve-2026-53676-thingsboard-prototype-pollution-sandbox-escape-in-js-executor  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-17. Updated: 2026-06-20  
License: CC BY 4.0 with a link back

CVE-2026-53676 · Severity: high · CVSS 7.2 · Published 2026-06-17

ThingsBoard, an open-source IoT platform, contains a security flaw that allows administrative users to bypass security restrictions. A user with Tenant Administrator privileges can exploit a technical weakness in how the system handles JavaScript to execute unauthorized code. This could allow an attacker to gain deeper access to the underlying server, potentially leading to data theft or full system compromise.

Technologies: [ThingsBoard](https://junglewise.ai/threats/technologies/thingsboard). Vendors: [ThingsBoard](https://junglewise.ai/threats/vendors/thingsboard).

## Quick answers

**Is CVE-2026-53676 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53676 being exploited in the wild.

**How severe is CVE-2026-53676?** High severity, with a CVSS score of 7.2, published 17 June 2026.

**Which products and versions are affected?** ThingsBoard prior to v4.3.1.2.

**Is there a fix for CVE-2026-53676?** A patch was published on 2026-05-14: Fix merged into lts-4.2 branch via Pull Request 15600 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-53676 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-53676?** Check whether you run ThingsBoard at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A prototype pollution vulnerability (CWE-1321) exists in the 'tb-js-executor' component of ThingsBoard. The vulnerability stems from the fact that script arguments passed into the sandbox environment carried the host realm's prototype chain. An attacker with 'TENANT_ADMIN' privileges can leverage this to reach the host's Function constructor via 'args.constructor.constructor', enabling an escape from the sandboxed context to execute arbitrary code on the host process. This can lead to unauthorized file access, shell command execution, and environment variable disclosure. The issue is addressed in version 4.3.1.2 by ensuring arguments are constructed within the sandbox context using 'vm.runInContext'.

## Affected products

- ThingsBoard ThingsBoard prior to v4.3.1.2

## Timeline

- 2026-05-14: patched: Fix merged into lts-4.2 branch via Pull Request 15600
- 2026-06-16: advisory: JVN advisory published
- 2026-06-17: disclosed: CVE published to NVD

## References

- [https://github.com/thingsboard/thingsboard/pull/15600](https://github.com/thingsboard/thingsboard/pull/15600)
- [https://jvn.jp/en/jp/JVN16937365/](https://jvn.jp/en/jp/JVN16937365/)
- [https://thingsboard.io/docs/releases/releases-table/](https://thingsboard.io/docs/releases/releases-table/)

## Related threats

- [ThingsBoard authentication bypass in OAuth authorization code exchange](https://junglewise.ai/threats/cve-2026-36537-thingsboard-authentication-bypass-in-oauth-authorization-code)
- [ThingsBoard code injection in YAML Handler provisioning API](https://junglewise.ai/threats/cve-2026-9568-thingsboard-code-injection-in-yaml-handler-provisioning-api)
- [ThingsBoard SSRF in Image Upload Gallery](https://junglewise.ai/threats/cve-2025-34282-thingsboard-ssrf-in-image-upload-gallery)