CVE-2026-25142

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-25142
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.27, SanboxJS does not properly restrict __lookupGetter__ which can be used to obtain prototypes, which can be used for escaping the sandbox / remote code execution. This vulnerability is fixed in 0.8.27.

10.0 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://github.com/nyariv/SandboxJS/blob/f212a38fb5a6d4bc2bc2e2466c0c011ce8d41072/src/executor.ts#L368-L398 Product
https://github.com/nyariv/SandboxJS/commit/75c8009db32e6829b0ad92ca13bf458178442bd3 Patch
https://github.com/nyariv/SandboxJS/security/advisories/GHSA-9p4w-fq8m-2hp7 Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:nyariv:sandboxjs:*:*:*:*:*:node.js:*:*
History

18 Feb 2026, 14:34

Type Values Removed Values Added
CWE CWE-1321
First Time Nyariv sandboxjs
Nyariv
CPE cpe:2.3:a:nyariv:sandboxjs:*:*:*:*:*:node.js:*:*
Summary
  • (es) SandboxJS es una biblioteca de sandboxing de JavaScript. Antes de la versión 0.8.27, SandboxJS no restringe adecuadamente __lookupGetter__, que puede usarse para obtener prototipos, lo que puede usarse para escapar del sandbox / ejecución remota de código. Esta vulnerabilidad está corregida en la versión 0.8.27.
References () https://github.com/nyariv/SandboxJS/blob/f212a38fb5a6d4bc2bc2e2466c0c011ce8d41072/src/executor.ts#L368-L398 - () https://github.com/nyariv/SandboxJS/blob/f212a38fb5a6d4bc2bc2e2466c0c011ce8d41072/src/executor.ts#L368-L398 - Product
References () https://github.com/nyariv/SandboxJS/commit/75c8009db32e6829b0ad92ca13bf458178442bd3 - () https://github.com/nyariv/SandboxJS/commit/75c8009db32e6829b0ad92ca13bf458178442bd3 - Patch
References () https://github.com/nyariv/SandboxJS/security/advisories/GHSA-9p4w-fq8m-2hp7 - () https://github.com/nyariv/SandboxJS/security/advisories/GHSA-9p4w-fq8m-2hp7 - Exploit, Vendor Advisory

02 Feb 2026, 23:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-02 23:16

Updated : 2026-02-18 14:34

NVD link : CVE-2026-25142

Mitre link : CVE-2026-25142

CVE.ORG link : CVE-2026-25142

JSON object : View

Products Affected

nyariv

  • sandboxjs
CWE
CWE-94

Improper Control of Generation of Code ('Code Injection')

CWE-1321

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')