CVE-2026-26954CWE-94

SandboxJS has a Sandbox Escape

Critical · published March 13, 2026

CVSS v3.1
10.0
EPSS
1%
Percentile
49.1
In the wild
Unconfirmed
What it is

SandboxJS is a JavaScript sandboxing library. Prior to 0.8.34, it is possible to obtain arrays containing Function, which allows escaping the sandbox. Given an array containing Function, and Object.fromEntries, it is possible to construct {[p]: Function} where p is any constructible property. This vulnerability is fixed in 0.8.34.

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00619 · 49.1th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-03-13T15:51Z
EPSS history
Timeline
  • 13 MAR 15:51Z
    SandboxJS has a Sandbox Escape
    cvelistv5