SandboxJS is a JavaScript sandboxing library. Prior to 0.9.6, sandbox-defined functions expose Function.caller, allowing sandboxed code to recover the internal LispType.Call runtime callback. That callback can then be invoked with attacker-controlled fake context and obj values to extract blocked host statics, recover the real host Function constructor, and execute arbitrary host JavaScript. This vulnerability is fixed in 0.9.6.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://github.com/nyariv/SandboxJS/commit/826865251232611ec94078bab5a18ec875dad4a5 Patch
- https://github.com/nyariv/SandboxJS/security/advisories/GHSA-g8f2-4f4f-5jqw Exploit, Vendor Advisory
- https://github.com/nyariv/SandboxJS/security/advisories/GHSA-g8f2-4f4f-5jqw Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 10.0 · nyarivNVD modified 2026-10-14 20:10
Affected (CPE criteria) 1
cpe:2.3:a:nyariv:sandboxjs:*:*:*:*:*:node.js:*:*