Description
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.31, a sandbox escape vulnerability allows sandboxed code to mutate host built-in prototypes by laundering the isGlobal protection flag through array literal intermediaries. When a global prototype reference (e.g., Map.prototype, Set.prototype) is placed into an array and retrieved, the isGlobal taint is stripped, permitting direct prototype mutation from within the sandbox. This results in persistent host-side prototype pollution and may enable RCE in applications that use polluted properties in sensitive sinks (example gadget: execSync(obj.cmd)). This vulnerability is fixed in 0.8.31.
INFO
Published Date :
2026-02-09T21:12:58.981Z
Last Modified :
2026-02-10T15:58:08.474Z
Source :
GitHub_M
AFFECTED PRODUCTS
The following products are affected by CVE-2026-25881 vulnerability.
| Vendors | Products |
|---|---|
| Nyariv |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2026-25881.
