CVE-2026-25520: 
JavaScript vulnerability analysis and mitigation

CVE-2026-25520 is a critical sandbox escape vulnerability in SandboxJS (@nyariv/sandboxjs), a JavaScript sandboxing library for Node.js. The flaw allows unauthenticated remote attackers to escape the sandbox and execute arbitrary code on the host system by exploiting improperly wrapped function return values. All versions up to and including 0.8.28 are affected; the issue was disclosed on February 5, 2026, and patched in version 0.8.29. It carries a CVSS v3.1 base score of 10.0 (Critical) (GitHub Advisory, SandboxJS Advisory).

The root cause is that SandboxJS fails to wrap the return values of functions executed within the sandbox (CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component). Because return values are not wrapped, an attacker can use Object.values() or Object.entries() on the sandbox's this context to obtain an array containing the host's native Function constructor. By then calling Array.prototype.at() on that array, the attacker retrieves the unwrapped host Function constructor and can invoke it to execute arbitrary JavaScript — including calls to process.getBuiltinModule('child_process').execSync() — entirely outside the sandbox's security boundary. Chaining these built-in methods bypasses all of SandboxJS's validation and sanitization logic. Multiple public proof-of-concept payloads are included in the official advisory (SandboxJS Advisory, GitHub Commit).

Successful exploitation results in a complete sandbox escape leading to remote code execution (RCE) on the host system with the privileges of the Node.js process running SandboxJS. An attacker achieves full compromise of confidentiality (access to all host data), integrity (ability to modify files and system state), and availability (ability to crash or disrupt the host). Because the scope is changed (S:C in CVSS), the impact extends beyond the sandboxed component to the underlying host environment, enabling lateral movement, data exfiltration, installation of malware, or further pivoting within the network (GitHub Advisory, SandboxJS Advisory).

Multiple proof-of-concept (PoC) exploit payloads are publicly available in the official GitHub Security Advisory, demonstrating sandbox escape to OS command execution with no authentication or user interaction required (SandboxJS Advisory). As of the time of reporting, there is no confirmed evidence of active in-the-wild exploitation, and no threat actor attribution has been made. The EPSS score is approximately 0.063% (0.000780 per Feedly), placing it in the 20th percentile for exploitation likelihood within 30 days. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Identify target: Locate Node.js applications that use @nyariv/sandboxjs version 0.8.28 or earlier and accept user-controlled input that is compiled and executed within the sandbox.
2. Craft malicious payload: Construct a JavaScript payload that uses Object.values(this).at(0) or Object.entries(this)[0].at(1) to extract the host's unwrapped Function constructor from the sandbox context.
3. Invoke host Function constructor: Call the extracted Function constructor with a string argument containing arbitrary JavaScript, such as "return process.getBuiltinModule('child_process').execSync('id').toString()".
4. Execute the returned function: Immediately invoke the result (e.g., Object.values(this).at(0)("return process.getBuiltinModule('child_process').execSync('ls -lah').toString()")()) to run OS commands on the host.
5. Achieve RCE: Use the child_process module to execute arbitrary system commands, establish a reverse shell, exfiltrate data, or perform further post-exploitation actions outside the sandbox (SandboxJS Advisory).

• Logs: Node.js application logs showing unexpected calls to Object.values, Object.entries, or Array.prototype.at within sandboxed code; error traces referencing child_process or execSync originating from SandboxJS execution context.
• Process: Unexpected child processes spawned by the Node.js process (e.g., sh, bash, cmd.exe, ls, id, whoami, curl, wget) that are not part of normal application behavior.
• Network: Unusual outbound network connections from the Node.js server process to unknown external IPs, particularly on non-standard ports, following sandbox code execution.
• File System: New or modified files in the application directory or system temp directories created by the Node.js process; presence of web shells, reverse shell scripts, or unauthorized executables.
• Application: Sandbox-compiled payloads containing strings such as Object.values(this), Object.entries(this), Array.prototype.at, getBuiltinModule, child_process, or execSync in user-supplied input (SandboxJS Advisory).

The vendor has released a fix in @nyariv/sandboxjs version 0.8.29, which hardens the sandbox by ensuring function return values are properly wrapped and restricts access to dangerous built-ins. Organizations should immediately upgrade from any version ≤ 0.8.28 to 0.8.29 or later via npm install @nyariv/sandboxjs@latest. As interim mitigations for systems that cannot be patched immediately: disable or restrict access to sandboxing functionality, run SandboxJS in isolated environments with minimal OS privileges (e.g., containers with restricted syscalls), implement network segmentation to limit blast radius, and monitor for suspicious function constructor access patterns in sandboxed code (GitHub Commit, GitHub Advisory).

The vulnerability was covered by security news outlets including The Hacker Wire and SecurityOnline.info, with the latter noting it as part of a broader set of critical SandboxJS flaws with CVSS 10.0 scores allowing host takeover (SecurityOnline). The Hacker Wire published a dedicated article titled "SandboxJS Escape: Unwrapped Functions Lead to RCE" and shared it on Mastodon and Bluesky. The vulnerability was also referenced in CISA's weekly vulnerability bulletin (SB26-040) and noted by INCIBE-CERT. Community reaction has focused on the severity of the complete sandbox escape and the availability of public PoC code in the official advisory.