10

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-26954

CVE-2026-26954: SandboxJS has a Sandbox Escape

SandboxJS is a JavaScript sandboxing library. Prior to 0.8.34, it is possible to obtain arrays containing Function, which allows escaping the sandbox. Given an array containing Function, and Object.fromEntries, it is possible to construct {[p]: Function} where p is any constructible property. This vulnerability is fixed in 0.8.34.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-26954

CVE-2026-26954:

10

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@nyariv/sandboxjs	npm	<= 0.8.33	0.8.34

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the SandboxJS execution engine, specifically in the handler for function calls made from within the sandboxed environment. The root cause was a failure to sanitize the return values of these function calls. When sandboxed code executed a native JavaScript function (e.g., Object.values(this)), the raw return value was passed back into the sandbox. The vulnerability could be triggered by calling a function that returns an array containing a reference to the host's Function constructor. With access to the Function constructor, an attacker could create and execute arbitrary code, escaping the sandbox and leading to Remote Code Execution (RCE). The patch addresses this by introducing a sanitizeArray function, which is now invoked on the return value of every function call. This new function recursively inspects arrays and replaces any references to sensitive objects like the Function constructor with their sandboxed, safe counterparts, effectively preventing the leak.

Vulnerable functions

addOps(LispType.Call handler)

src/executor.ts

This anonymous handler function for `LispType.Call` is responsible for executing function calls originating from the sandboxed code. Prior to the patch, it would return the results of these function calls without sanitization. This allowed built-in functions like `Object.values(this)` to return an array containing a reference to the powerful `Function` constructor, which could then be used to escape the sandbox and achieve remote code execution. The patch fixes this by calling the new `sanitizeArray` function on the return values to replace sensitive objects like the `Function` constructor with their safe, sandboxed equivalents.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.