CVE-2026-25142: 
JavaScript vulnerability analysis and mitigation

CVE-2026-25142 is a critical sandbox escape and remote code execution vulnerability in SandboxJS (@nyariv/sandboxjs), a JavaScript sandboxing library for Node.js. The flaw stems from improper restriction of the __lookupGetter__ method, which allows attackers to traverse the prototype chain and escape the sandbox. All versions up to and including 0.8.26 are affected; the issue was fixed in version 0.8.27. It was published on January 31, 2026, and carries a CVSS v3.1 base score of 10.0 (Critical) (GitHub Advisory).

The root cause is classified under CWE-94 (Improper Control of Code Generation) and CWE-1321 (Prototype Pollution). In src/executor.ts (lines 368–398), the sandbox correctly protects the Object prototype, but a special case for accessing function properties bypasses the prototype chain checks — including the root Object prototype — allowing __lookupGetter__ to be called on function objects like Object.toString. An attacker can use this to retrieve the __proto__ getter, call it on a sandboxed object (e.g., a Map), and then leverage the resulting prototype access to invoke Function.constructor with arbitrary code strings, ultimately calling process.getBuiltinModule('child_process').execSync(). No authentication or user interaction is required; the attacker only needs the ability to supply JavaScript code to the sandbox (GitHub Advisory, SandboxJS Commit).

Successful exploitation results in complete system compromise on the host running the vulnerable Node.js application. An attacker can execute arbitrary OS commands with the privileges of the Node.js process, leading to full confidentiality, integrity, and availability impact — including data exfiltration, file system manipulation, and service disruption. Because the scope is marked as "Changed" in the CVSS vector, the impact extends beyond the sandboxed component to the underlying host system, enabling potential lateral movement within the infrastructure (GitHub Advisory).

A fully functional proof-of-concept exploit is publicly available in the SandboxJS security advisory, demonstrating RCE via child_process.execSync(). The exploit requires no authentication, no privileges, and no user interaction, making it trivially weaponizable by any attacker who can submit JavaScript to a SandboxJS-powered endpoint. As of the time of reporting, there is no confirmed evidence of in-the-wild exploitation, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.11–0.26%, reflecting low but non-negligible exploitation probability in the near term (GitHub Advisory, Feedly).

1. Identify target: Locate applications using @nyariv/sandboxjs versions ≤ 0.8.26 in Node.js environments — particularly those that accept user-supplied JavaScript for sandboxed execution (e.g., template engines, plugin systems, AI code execution platforms).
2. Craft the prototype pollution payload: Construct a JavaScript payload that calls __lookupGetter__ on a whitelisted function property (e.g., Object.toString.__lookupGetter__("__proto__")) to obtain the __proto__ getter without triggering sandbox restrictions.
3. Traverse the prototype chain: Invoke the retrieved getter on a sandboxed object (e.g., new Map()) to obtain its prototype, then overwrite a method on that prototype (e.g., m.has = isFinite) to gain access to an unsandboxed function reference.
4. Access Function.constructor: Use the unsandboxed function reference's .constructor property (e.g., isFinite.constructor) to obtain the native Function constructor, which is not subject to sandbox restrictions.
5. Execute arbitrary code: Call isFinite.constructor("return process.getBuiltinModule('child_process').execSync('ls -lah').toString()")() to execute arbitrary OS commands on the host system.
6. Achieve objective: Use the RCE primitive to establish a reverse shell, exfiltrate data, or pivot to other systems on the network (GitHub Advisory).

• Logs: Node.js application logs showing unexpected calls to child_process methods (execSync, exec, spawn) originating from sandboxed code execution paths; error logs referencing __lookupGetter__, __proto__, or prototype chain traversal in sandbox contexts.
• Process: Unusual child processes spawned by the Node.js process (e.g., sh, bash, cmd.exe, curl, wget, python) that are not part of normal application behavior; unexpected network connections initiated by the Node.js process.
• Network: Outbound connections from the Node.js server to unknown external IPs or C2 infrastructure, particularly shortly after sandbox code execution events; DNS lookups for unfamiliar domains from the application host.
• File System: New or modified files in the application directory or system temp folders created by the Node.js process; unexpected cron jobs, scheduled tasks, or startup scripts added by the application user account (GitHub Advisory).

The vendor has released a patch in SandboxJS version 0.8.27, which hardens the sandbox by removing the special-case bypass for function property access and ensuring prototype chain checks apply uniformly, including to the root Object prototype. All users of @nyariv/sandboxjs should immediately upgrade to version 0.8.27 or later via npm install @nyariv/sandboxjs@0.8.27. No configuration-based workaround is available; upgrading is the only effective remediation. Organizations should audit all Node.js applications and dependencies for use of vulnerable SandboxJS versions and prioritize patching given the CVSS 10.0 severity and public PoC availability (GitHub Advisory, SandboxJS Commit).

The vulnerability was reported by security researcher c0rydoras and published by the repository maintainer nyariv on January 31, 2026. Coverage appeared on TheHackerWire, which published a dedicated write-up on the prototype chain abuse technique, and the advisory was shared on Mastodon and Bluesky by security community accounts. The CISA vulnerability bulletin for the week of February 2, 2026 included this CVE, and it was noted in community PoC roundups such as the "PoC Week" digest. The vulnerability also attracted attention due to its potential impact on AI code execution platforms (e.g., OpenClaw AI) that use SandboxJS for user-submitted code isolation (TheHackerWire, CISA Bulletin).