Moole Vulnerability Database

Find real vulnerabilities before they ship

Critical

CVE-2026-26954

SandboxJS is a JavaScript sandboxing library. Prior to 0.8.34, it is possible to obtain arrays containing Function, which allows escaping the sandbox. Given an array containing Function, and Object.fromEntries, it is possible to construct {[p]: Function} where p is any constructible property. This vulnerability is fixed in 0.8.34.

VectorNETWORK

PublishedMar 13, 2026, 19:54

Published Bysecurity-advisories@github.com

Base Score

Score10

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

@nyariv/sandboxjs(npm)00.8.34N/A

References

https://github.com/nyariv/SandboxJS/security/advisories/GHSA-6r9f-759j-hjgv

Weakness Type

CWE-94

CVSS Metrics

Base Score

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Base SeverityCritical

Version

3.1

Attack Vector (AV)

NETWORK