CVE-2026-32723 SandboxJS timers have an execution-quota bypass (cross-sandbox currentTicks race)
Attackers can bypass execution quotas in SandboxJS by exploiting a race condition in shared timer state, allowing resource exhaustion or quota evasion.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-32723?
CVE-2026-32723 is a medium-severity vulnerability in nyariv SandboxJS, published on 18 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.35, SandboxJS timers have an execution-quota bypass. A global tick state (`currentTicks.current`) is shared between sandboxes. Timer string handlers are compiled at execution time using that global tick state rather than the scheduling sandbox's tick object. In multi-tenant / concurrent sandbox scenarios, another sandbox can overwrite `currentTicks.current` between scheduling and execution, causing the timer callback to run under a different sandbox's tick budget and bypass the original sandbox's execution quota/watchdog. Version 0.8.35 fixes this issue.
Weakness: CWE-362
Which versions are affected by CVE-2026-32723?
2 open source packages ship an affected version, including @nyariv/sandboxjs. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@nyariv/sandboxjs npm | All versions | 0.8.35 |
@nyariv/sandboxjs npm | All versions | 0.8.35 |
Products include Nyariv Sandboxjs.
How do I fix CVE-2026-32723?
Upgrade @nyariv/sandboxjs to 0.8.35 or later.
Is CVE-2026-32723 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32723 exists.
Other vulnerabilities in nyariv SandboxJS
- CVE-2026-43898 SandboxJS: Sandbox escape via Function.caller leakage of internal call op
- CVE-2026-34208 SandboxJS: Sandbox integrity escape
- CVE-2026-26954 SandboxJS has a Sandbox Escape
- CVE-2026-25520 SandboxJS has a Sandbox Escape
- CVE-2026-25586 SandboxJS has a Sandbox Escape via Prototype Whitelist Bypass and Host Prototype Pollution
Sources
Also known as GHSA-7p5m-xrh7-769r.