CVE-2026-34217

SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, a scope modification vulnerability exists in @nyariv/sandboxjs. The vulnerability allows untrusted sandboxed code to leak internal interpreter objects through the new operator, exposing sandbox scope objects in the scope hierarchy to untrusted code; an unexpected and undesired exploit. While this could allow modifying scopes inside the sandbox, code evaluation remains sandboxed and prototypes remain protected throughout the execution. This vulnerability is fixed in 0.8.36.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/nyariv/SandboxJS/security/advisories/GHSA-hg73-4w7g-q96w	Exploit Mitigation Vendor Advisory
https://github.com/nyariv/SandboxJS/security/advisories/GHSA-hg73-4w7g-q96w	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nyariv:sandboxjs:*:*:*:*:*:node.js:*:*

History

26 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) SandboxJS es una biblioteca de sandboxing de JavaScript. Antes de 0.8.36, existe una vulnerabilidad de modificación de alcance en @nyariv/sandboxjs. La vulnerabilidad permite que código sandboxed no confiable filtre objetos internos del intérprete a través del operador new, exponiendo objetos de alcance del sandbox en la jerarquía de alcance a código no confiable; un exploit inesperado e indeseado. Si bien esto podría permitir modificar alcances dentro del sandbox, la evaluación del código permanece sandboxed y los prototipos permanecen protegidos durante toda la ejecución. Esta vulnerabilidad está corregida en 0.8.36.

Information

Published : 2026-04-06 16:16

Updated : 2026-10-26 22:10

NVD link : CVE-2026-34217

Mitre link : CVE-2026-34217

CVE.ORG link : CVE-2026-34217

JSON object : View

Products Affected

nyariv

sandboxjs

CWE

CWE-668

Exposure of Resource to Wrong Sphere

{"id": "CVE-2026-34217", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34217", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-06T15:33:58.430676Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "nyariv", "product": "SandboxJS", "versions": [{"status": "affected", "version": "< 0.8.36"}]}]}], "published": "2026-04-06T16:16:34.890", "references": [{"url": "https://github.com/nyariv/SandboxJS/security/advisories/GHSA-hg73-4w7g-q96w", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nyariv/SandboxJS/security/advisories/GHSA-hg73-4w7g-q96w", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-668"}]}], "descriptions": [{"lang": "en", "value": "SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, a scope modification vulnerability exists in @nyariv/sandboxjs. The vulnerability allows untrusted sandboxed code to leak internal interpreter objects through the new operator, exposing sandbox scope objects in the scope hierarchy to untrusted code; an unexpected and undesired exploit. While this could allow modifying scopes inside the sandbox, code evaluation remains sandboxed and prototypes remain protected throughout the execution. This vulnerability is fixed in 0.8.36."}, {"lang": "es", "value": "SandboxJS es una biblioteca de sandboxing de JavaScript. Antes de 0.8.36, existe una vulnerabilidad de modificaci\u00f3n de alcance en @nyariv/sandboxjs. La vulnerabilidad permite que c\u00f3digo sandboxed no confiable filtre objetos internos del int\u00e9rprete a trav\u00e9s del operador new, exponiendo objetos de alcance del sandbox en la jerarqu\u00eda de alcance a c\u00f3digo no confiable; un exploit inesperado e indeseado. Si bien esto podr\u00eda permitir modificar alcances dentro del sandbox, la evaluaci\u00f3n del c\u00f3digo permanece sandboxed y los prototipos permanecen protegidos durante toda la ejecuci\u00f3n. Esta vulnerabilidad est\u00e1 corregida en 0.8.36."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nyariv:sandboxjs:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "F87D3BD6-FACF-45C3-92E4-F411C229C9C6", "versionEndExcluding": "0.8.36"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}