CVE-2026-43898CWE-94code-injection

CVE-2026-43898

Critical · published May 28, 2026

CVSS v3.1
10.0
EPSS
1%
Percentile
49.6
In the wild
Unconfirmed
What it is

SandboxJS is a JavaScript sandboxing library. Prior to 0.9.6, sandbox-defined functions expose Function.caller, allowing sandboxed code to recover the internal LispType.Call runtime callback. That callback can then be invoked with attacker-controlled fake context and obj values to extract blocked host statics, recover the real host Function constructor, and execute arbitrary host JavaScript. This vulnerability is fixed in 0.9.6.

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00632 · 49.6th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-05-28T22:16Z
Affected products (1)
ProductVersionsFixed in
nyariv/sandboxjs< 0.9.60.9.6
References (3)
https://github.com/nyariv/SandboxJS/commit/826865251232611ec94078bab5a18ec875dad4a5 · [email protected]https://github.com/nyariv/SandboxJS/security/advisories/GHSA-g8f2-4f4f-5jqw · [email protected]https://github.com/nyariv/SandboxJS/security/advisories/GHSA-g8f2-4f4f-5jqw · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 28 MAY 17:50Z
    SandboxJS: Sandbox escape via Function.caller leakage of internal call op
    cvelistv5