CVE-2026-26954 SandboxJS has a Sandbox Escape

Critical 10.0 Published 13 Mar 2026 Updated 16 Mar 2026

Attackers can escape the SandboxJS sandbox to execute arbitrary code by exploiting a flaw in how Function objects are handled within arrays.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-26954?

CVE-2026-26954 is a critical code injection vulnerability in nyariv SandboxJS, published on 13 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

SandboxJS is a JavaScript sandboxing library. Prior to 0.8.34, it is possible to obtain arrays containing Function, which allows escaping the sandbox. Given an array containing Function, and Object.fromEntries, it is possible to construct {[p]: Function} where p is any constructible property. This vulnerability is fixed in 0.8.34.

Weakness: CWE-94

Which versions are affected by CVE-2026-26954?

2 open source packages ship an affected version, including @nyariv/sandboxjs. It affects 1 product.

Package	Affected	Fixed in
`@nyariv/sandboxjs` npm	All versions	`0.8.34`
`@nyariv/sandboxjs` npm	All versions	`0.8.34`

Products include Nyariv Sandboxjs.

How do I fix CVE-2026-26954?

Upgrade @nyariv/sandboxjs to 0.8.34 or later.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2026-26954 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-26954 exists.

Sources

Also known as GHSA-6r9f-759j-hjgv.