CVE-2026-34208

SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, SandboxJS blocks direct assignment to global objects (for example Math.random = ...), but this protection can be bypassed through an exposed callable constructor path: this.constructor.call(target, attackerObject). Because this.constructor resolves to the internal SandboxGlobal function and Function.prototype.call is allowed, attacker code can write arbitrary properties into host global objects and persist those mutations across sandbox instances in the same process. This vulnerability is fixed in 0.8.36.

CVSS v3 10.0 CRITICAL

10.0^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://github.com/nyariv/SandboxJS/security/advisories/GHSA-2gg9-6p7w-6cpj	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nyariv:sandboxjs:*:*:*:*:*:node.js:*:*

History

26 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) SandboxJS es una biblioteca de sandboxing de JavaScript. Antes de 0.8.36, SandboxJS bloquea la asignación directa a objetos globales (por ejemplo, Math.random = ...), pero esta protección puede ser eludida a través de una ruta de constructor invocable expuesta: this.constructor.call(target, attackerObject). Debido a que this.constructor se resuelve en la función interna SandboxGlobal y Function.prototype.call está permitido, el código del atacante puede escribir propiedades arbitrarias en objetos globales del host y persistir esas mutaciones a través de instancias de sandbox en el mismo proceso. Esta vulnerabilidad está corregida en 0.8.36.

Information

Published : 2026-04-06 16:16

Updated : 2026-10-26 22:10

NVD link : CVE-2026-34208

Mitre link : CVE-2026-34208

CVE.ORG link : CVE-2026-34208

JSON object : View

Products Affected

nyariv

sandboxjs

CWE

CWE-693

Protection Mechanism Failure

CWE-915

Improperly Controlled Modification of Dynamically-Determined Object Attributes

{"id": "CVE-2026-34208", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34208", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-06T18:39:04.774704Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "nyariv", "product": "SandboxJS", "versions": [{"status": "affected", "version": "< 0.8.36"}]}]}], "published": "2026-04-06T16:16:34.580", "references": [{"url": "https://github.com/nyariv/SandboxJS/security/advisories/GHSA-2gg9-6p7w-6cpj", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-693"}, {"lang": "en", "value": "CWE-915"}]}], "descriptions": [{"lang": "en", "value": "SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, SandboxJS blocks direct assignment to global objects (for example Math.random = ...), but this protection can be bypassed through an exposed callable constructor path: this.constructor.call(target, attackerObject). Because this.constructor resolves to the internal SandboxGlobal function and Function.prototype.call is allowed, attacker code can write arbitrary properties into host global objects and persist those mutations across sandbox instances in the same process. This vulnerability is fixed in 0.8.36."}, {"lang": "es", "value": "SandboxJS es una biblioteca de sandboxing de JavaScript. Antes de 0.8.36, SandboxJS bloquea la asignaci\u00f3n directa a objetos globales (por ejemplo, Math.random = ...), pero esta protecci\u00f3n puede ser eludida a trav\u00e9s de una ruta de constructor invocable expuesta: this.constructor.call(target, attackerObject). Debido a que this.constructor se resuelve en la funci\u00f3n interna SandboxGlobal y Function.prototype.call est\u00e1 permitido, el c\u00f3digo del atacante puede escribir propiedades arbitrarias en objetos globales del host y persistir esas mutaciones a trav\u00e9s de instancias de sandbox en el mismo proceso. Esta vulnerabilidad est\u00e1 corregida en 0.8.36."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nyariv:sandboxjs:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "F87D3BD6-FACF-45C3-92E4-F411C229C9C6", "versionEndExcluding": "0.8.36"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}