CVE-2026-34208 SandboxJS: Sandbox integrity escape

Critical 10.0 Published 6 Apr 2026 Updated 6 Apr 2026

Attackers can bypass SandboxJS protections to modify host global objects, potentially leading to code execution or sandbox escape.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-34208?

CVE-2026-34208 is a critical vulnerability in nyariv SandboxJS, published on 6 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, SandboxJS blocks direct assignment to global objects (for example Math.random = ...), but this protection can be bypassed through an exposed callable constructor path: this.constructor.call(target, attackerObject). Because this.constructor resolves to the internal SandboxGlobal function and Function.prototype.call is allowed, attacker code can write arbitrary properties into host global objects and persist those mutations across sandbox instances in the same process. This vulnerability is fixed in 0.8.36.

Weakness: CWE-915, CWE-693

Which versions are affected by CVE-2026-34208?

2 open source packages ship an affected version, including @nyariv/sandboxjs. It affects 1 product.

Package	Affected	Fixed in
`@nyariv/sandboxjs` npm	All versions	`0.8.36`
`@nyariv/sandboxjs` npm	All versions	`0.8.36`

Products include Nyariv Sandboxjs.

How do I fix CVE-2026-34208?

Upgrade @nyariv/sandboxjs to 0.8.36 or later.

Is CVE-2026-34208 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-34208 exists.

Sources

Also known as GHSA-2gg9-6p7w-6cpj.