4.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32723

CVE-2026-32723: SandboxJS timers have an execution-quota bypass (cross-sandbox currentTicks race)

SandboxJS is a JavaScript sandboxing library. Prior to 0.8.35, SandboxJS timers have an execution-quota bypass. A global tick state (currentTicks.current) is shared between sandboxes. Timer string handlers are compiled at execution time using that global tick state rather than the scheduling sandbox's tick object. In multi-tenant / concurrent sandbox scenarios, another sandbox can overwrite currentTicks.current between scheduling and execution, causing the timer callback to run under a different sandbox's tick budget and bypass the original sandbox's execution quota/watchdog. Version 0.8.35 fixes this issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-32723

CVE-2026-32723:

4.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@nyariv/sandboxjs	npm	<= 0.8.34	0.8.35

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a race condition in SandboxJS that allows for an execution-quota bypass. The root cause is the use of a globally shared variable, currentTicks.current, to track the execution ticks for different sandboxes. The function _execNoneRecurse in src/executor.ts would set this global variable each time a sandbox executed code. The vulnerability is triggered when using timers with string handlers (e.g., setTimeout("code", ...)). These handlers are compiled just before execution, not when they are scheduled. This compilation process involves functions like sandboxFunction, sandboxAsyncFunction, and sandboxedEval from src/eval.ts. These functions would read the currentTicks.current value to get the execution budget. In a concurrent environment, if Sandbox A schedules a timer and then Sandbox B runs before the timer fires, Sandbox B's execution will set currentTicks.current to its own tick object. When Sandbox A's timer finally executes, its code is compiled using Sandbox B's tick budget, effectively bypassing the quota set for Sandbox A. The patch resolves this by removing the global currentTicks object entirely and instead passing the correct tick object through the execution context (context.ctx.ticks), ensuring each sandbox's execution is tracked against its own budget.

Vulnerable functions

_execNoneRecurse

src/executor.ts

This function was responsible for setting a global `currentTicks.current` variable to the ticks object of the currently executing sandbox. This created a race condition where concurrent sandboxes could overwrite this shared state, allowing a timer from one sandbox to be executed with the tick budget of another, thus bypassing execution quotas.

sandboxFunction

src/eval.ts

This function used the vulnerable global `currentTicks.current` as a fallback for the ticks object when creating a new function for the sandbox. When a timer string handler was compiled, this function would be called and would read the potentially incorrect global tick state, leading to an execution quota bypass.

sandboxAsyncFunction

src/eval.ts

Similar to `sandboxFunction`, this asynchronous version also used the vulnerable global `currentTicks.current` when creating an async function, making it susceptible to the same race condition and quota bypass vulnerability.

sandboxedEval

src/eval.ts

This function directly used the global `currentTicks.current` to create a function from a pre-parsed lisp tree. This made it a vulnerable component in the execution flow of sandboxed code, as it relied on the incorrect, globally shared tick state.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.