CVE-2026-25520 SandboxJS has a Sandbox Escape

Critical 10.0 Published 6 Feb 2026 Updated 6 Feb 2026

Attackers can escape the SandboxJS sandbox to execute arbitrary code on the host by accessing the Function constructor via unreturned values.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-25520?

CVE-2026-25520 is a critical code injection vulnerability in nyariv SandboxJS, published on 6 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, The return values of functions aren't wrapped. Object.values/Object.entries can be used to get an Array containing the host's Function constructor, by using Array.prototype.at you can obtain the hosts Function constructor, which can be used to execute arbitrary code outside of the sandbox. This vulnerability is fixed in 0.8.29.

Weakness: CWE-74

Which versions are affected by CVE-2026-25520?

2 open source packages ship an affected version, including @nyariv/sandboxjs. It affects 1 product.

Package	Affected	Fixed in
`@nyariv/sandboxjs` npm	All versions	`0.8.29`
`@nyariv/sandboxjs` npm	All versions	`0.8.29`

Products include Nyariv Sandboxjs.

How do I fix CVE-2026-25520?

Upgrade @nyariv/sandboxjs to 0.8.29 or later.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2026-25520 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-25520 exists.

Sources

Also known as GHSA-58jh-xv4v-pcx4.