Critical · published February 6, 2026
🚨 A sneaky oversight in SandboxJS lets attackers escape the confines of their safe space! Before version 0.8.29, function return values weren't wrapped, opening the door to code execution outside the sandbox. 🔥 Think of it like a restaurant where the chef accidentally left a back door open — a clever diner can slip into the kitchen and modify their meal to their liking without anyone noticing! If exploited, this vulnerability could allow an attacker to execute arbitrary code on the host system, potentially leading to a complete takeover. Imagine the chaos if someone injected malicious commands into your otherwise secure environment — it's absolutely devastating!
Think of it like a restaurant where the chef accidentally left a back door open — a clever diner can slip into the kitchen and modify their meal to their liking without anyone noticing! This vulnerability in SandboxJS arises because function return values are not properly controlled, allowing access to the host's Function constructor. An attacker can leverage Object.values and Array.prototype.at to escape the sandbox and run malicious code at will.
If exploited, this vulnerability could allow an attacker to execute arbitrary code on the host system, potentially leading to a complete takeover. Imagine the chaos if someone injected malicious commands into your otherwise secure environment — it's absolutely devastating! Upgrade SandboxJS to version 0.8.29 immediately to close this critical gap. Additionally, review your code to ensure proper sandboxing practices are maintained. Don't forget to audit any libraries that rely on this! You've got this! 🛡️ With these steps, your environment will be much safer in no time!