sandboxjs vulnerabilities
CVEs whose affected-version data names the sandboxjs package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-43898Critical· 10.0SandboxJS is a JavaScript sandboxing library
SandboxJS is a JavaScript sandboxing library. Prior to 0.9.6, sandbox-defined functions expose Function.caller, allowing sandboxed code to recover the internal LispType.Call runtime callback. That callback can then be invoked with attack…
▾ Midnightnyariv · sandboxjsEPSS 0.47%via NVD
CVE-2025-34146High· 7.0PoCA prototype pollution vulnerability exists in @nyariv/sandboxjs versions <= 0.8.23, allowing attackers to inject arbitrary properties into Object.prototype via crafted JavaScript code
A prototype pollution vulnerability exists in @nyariv/sandboxjs versions <= 0.8.23, allowing attackers to inject arbitrary properties into Object.prototype via crafted JavaScript code. This can result in a denial-of-service (DoS) conditi…
▾ Midnightnyariv · sandboxjsEPSS 0.23%via NVD