10

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25520

CVE-2026-25520: SandboxJS has a Sandbox Escape

SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, The return values of functions aren't wrapped. Object.values/Object.entries can be used to get an Array containing the host's Function constructor, by using Array.prototype.at you can obtain the hosts Function constructor, which can be used to execute arbitrary code outside of the sandbox. This vulnerability is fixed in 0.8.29.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25520

CVE-2026-25520:

10

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@nyariv/sandboxjs	npm	<= 0.8.28	0.8.29

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability in @nyariv/sandboxjs is a classic sandbox escape caused by improper handling of return values from function calls and property access within the sandboxed environment. The core issue was that the sandbox did not wrap or sanitize values returned from function calls or when accessing object properties. This allowed an attacker to execute code that, while appearing safe, could leak references to powerful objects from the host's (Node.js) environment.

The primary exploit vector demonstrated in the Proof of Concept involves calling Object.values(this) or Object.entries(this). Inside the sandbox, this refers to the global object. The Object.values function, when called on the sandboxed global object, would return an array containing all its properties, including a raw, unsandboxed reference to the host's Function constructor. By accessing this Function constructor from the returned array, an attacker could create and execute arbitrary code with the full permissions of the underlying Node.js process, completely bypassing the sandbox.

The patch addresses this by modifying the core execution logic in src/executor.ts. Specifically, the handlers for LispType.Call (function calls) and LispType.Prop (property access) were updated:

For LispType.Call: The return value of every function call is now intercepted. If the value is a function, it is wrapped in a sandboxed equivalent. If it is the global globalThis object, it is replaced by the sandbox's internal global object.
For LispType.Prop: When a property is accessed on an object, the value is checked. Similar to function calls, if the property is a function or globalThis, it is wrapped or replaced accordingly.

These changes ensure that malicious code cannot obtain direct references to powerful, exploitable objects from the host environment, effectively closing the sandbox escape vulnerability.

Vulnerable functions

LispType.Call handler

src/executor.ts

The vulnerability lies in the handler for function calls (`LispType.Call`). Before the patch, the return value of a function call was passed directly to the continuation callback (`done`) without any sanitization. This meant that if a sandboxed function returned a reference to a host object (e.g., the `Function` constructor via `Object.values`), the calling code would receive a raw, powerful object, allowing for a sandbox escape. The patch intercepts the return value, checks if it's a function or `globalThis`, and wraps or replaces it with a sandboxed equivalent before passing it on.

LispType.Prop handler

src/executor.ts

The property access handler (`LispType.Prop`) was also vulnerable. It would return raw properties from objects. If a property was a function from the host environment (not a sandboxed function), it was returned unwrapped. This could be exploited to gain access to sensitive functions on object prototypes. The patch ensures that if a property is a function, it is properly wrapped, and if it is `globalThis`, it is replaced with the sandboxed global object.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.