CVE-2026-25641 SandboxJS has a sandbox escape via TOCTOU bug on keys in property accesses

Critical 10.0 Published 6 Feb 2026 Updated 6 Feb 2026

Attackers can escape the SandboxJS sandbox by exploiting a time-of-check time-of-use race condition in property key validation, leading to arbitrary code execution.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-25641?

CVE-2026-25641 is a critical vulnerability in nyariv SandboxJS, published on 6 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, there is a sandbox escape vulnerability due to a mismatch between the key on which the validation is performed and the key used for accessing properties. Even though the key used in property accesses is annotated as string, this is never enforced. So, attackers can pass malicious objects that coerce to different string values when used, e.g., one for the time the key is sanitized using hasOwnProperty(key) and a different one for when the key is used for the actual property access. This vulnerability is fixed in 0.8.29.

Weakness: CWE-367

Which versions are affected by CVE-2026-25641?

2 open source packages ship an affected version, including @nyariv/sandboxjs. It affects 1 product.

Package	Affected	Fixed in
`@nyariv/sandboxjs` npm	All versions	`0.8.29`
`@nyariv/sandboxjs` npm	All versions	`0.8.29`

Products include Nyariv Sandboxjs.

How do I fix CVE-2026-25641?

Upgrade @nyariv/sandboxjs to 0.8.29 or later.

Is CVE-2026-25641 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-25641 exists.

Sources

Also known as GHSA-7x3h-rm86-3342.