Executive brief
The npm sandbox package is a JavaScript library designed to execute untrusted code in an isolated environment. A critical vulnerability allows attackers to bypass the sandbox restrictions and execute arbitrary code on the host system by exploiting a prototype chain weakness, potentially giving complete access to environment variables, file systems, and system processes.
Technical details
The vulnerability is a sandbox escape caused by insufficient restriction of access to the JavaScript constructor chain. An attacker can exploit this.constructor.constructor to gain access to the Function constructor, allowing arbitrary code execution outside the sandbox boundary. The attack vector is simple: evaluating payloads like `this.constructor.constructor('return process.env')()` grants immediate access to sensitive system information. No authentication is required—any code executed within the sandbox can trigger the escape. No fix is currently available for affected versions (<1.0.0), and the advisory recommends using alternative packages.
Affected products
- npm sandbox < 1.0.0
Timeline
- 2020-09-04: disclosed
- 2020-08-31: advisory