CVE-2026-25586: 
JavaScript vulnerability analysis and mitigation

CVE-2026-25586 is a critical sandbox escape vulnerability in SandboxJS (@nyariv/sandboxjs), a JavaScript sandboxing library for Node.js. It allows unauthenticated remote attackers to bypass prototype whitelist enforcement by shadowing hasOwnProperty on a sandbox object, enabling host Object.prototype pollution and persistent cross-sandbox impact. All versions up to and including 0.8.28 are affected; the issue was confirmed reproducible on Node v23.9.0. It carries a CVSS v3.1 base score of 10.0 (Critical) (Github Advisory, GHSA Advisory). The vulnerability was published on February 5, 2026, and patched in version 0.8.29 released the same day.

The root cause (CWE-74: Injection) lies in src/executor.ts, where the prototypeAccess check calls a.hasOwnProperty(b) directly on the sandboxed object rather than using Object.prototype.hasOwnProperty.call(a, b). An attacker-controlled object can shadow hasOwnProperty with a function that always returns true, causing the whitelist check to be skipped and prototypeAccess to evaluate to false — which bypasses all prototype whitelist enforcement at lines 367–399. The mutation guard at lines 220–233 is similarly vulnerable, as it also calls obj.context.hasOwnProperty(...) directly. An additional finding (not requiring the hasOwnProperty bypass) allows prototype mutation via intermediate references, e.g., accessing [].constructor.prototype through allowed static access and then mutating it via a local variable, bypassing isGlobal checks. The bypass works with the default Sandbox configuration and requires no custom globals or whitelists (GHSA Advisory).

Successful exploitation allows an attacker to fully escape the sandbox and pollute the host Object.prototype, affecting all JavaScript objects in the host process — including those in other sandboxed execution contexts, creating persistent cross-sandbox impact. Concrete consequences include unauthorized access to sensitive host data via prototype chain manipulation, logic bypass (e.g., setting isAdmin: true on all objects), denial of service by overriding Object.prototype.toString, and remote code execution by injecting properties (e.g., cmd) that are later consumed by host-side gadgets such as execSync. The scope change (S:C) in the CVSS score reflects that the impact extends beyond the vulnerable sandboxed component to the broader host environment (GHSA Advisory, Github Advisory).

Multiple proof-of-concept exploits are publicly available in the GitHub Security Advisory, demonstrating prototype pollution, logic bypass, DoS, and RCE via host gadgets (GHSA Advisory). The vulnerability requires no privileges, no user interaction, and no special configuration — making it trivially exploitable by any network-accessible attacker who can submit code to a SandboxJS instance. The EPSS score is approximately 0.039% (12th percentile), and there is no current evidence of in-the-wild exploitation or threat actor attribution (Github Advisory). The vulnerability is not currently listed in the CISA KEV catalog.

1. Identify target: Locate a Node.js application using @nyariv/sandboxjs version ≤ 0.8.28 that accepts and executes user-supplied JavaScript code through the sandbox.compile() API.
2. Craft bypass payload: Construct a sandboxed object that shadows hasOwnProperty with a function returning true, disabling the prototype whitelist check:

   const o = { hasOwnProperty: () => true };

3. Access blocked prototype: Use the shadowed object to access __proto__, which would normally be blocked by the whitelist:

   const proto = o.__proto__;

4. Pollute host Object.prototype: Write arbitrary properties to the prototype, affecting all objects in the host process:

   proto.polluted = 'pwned';
   proto.isAdmin = true;

5. Escalate to RCE (if host gadget available): Inject a property name matching a parameter consumed by a host-side function (e.g., proto.cmd = 'id'), then trigger execution via a host gadget such as execSync(obj.cmd) where obj is an ordinary host object that inherits the polluted property.
6. Alternative — Array.prototype mutation (no bypass needed): Access [].constructor.prototype via allowed static access and mutate built-in methods (e.g., filter) to disrupt host application logic without requiring the hasOwnProperty shadow (GHSA Advisory).

• Logs: Node.js application logs showing unexpected property access patterns on __proto__ or Object.prototype; errors originating from overridden built-in methods (e.g., toString, filter) in host code that did not previously throw.
• Process Behavior: Unexpected child processes (e.g., sh, bash, id, whoami) spawned by the Node.js process hosting SandboxJS; unusual execSync or child_process calls triggered by objects with inherited prototype properties.
• Application State: Unexpected properties appearing on plain objects ({}) at runtime (e.g., ({}).polluted, ({}).isAdmin === true), indicating Object.prototype has been modified.
• Network: Outbound connections from the Node.js server process to unexpected external hosts, potentially indicating post-exploitation activity following RCE via prototype pollution gadget chains.

Update @nyariv/sandboxjs to version 0.8.29 or later, which hardens the sandbox against this bypass via commit 67cb186c41c78c51464f70405504e8ef0a6e43c3 (Patch Commit). The fix replaces direct a.hasOwnProperty(b) calls with safe alternatives that cannot be shadowed by attacker-controlled objects. If immediate patching is not possible, consider restricting or disabling user-supplied code execution through SandboxJS, and implement network-level controls to limit exposure of the affected service. Given the CVSS 10.0 score, zero-privilege requirement, and public PoC availability, patching should be treated as urgent (Github Advisory).

The vulnerability received coverage from security news outlets including The Hacker Wire and SecurityOnline.info, with the latter noting it as part of a set of critical SandboxJS flaws with CVSS 10.0 scores (SecurityOnline, The Hacker Wire). The vulnerability was also referenced in CISA's weekly vulnerability bulletin for the week of February 2, 2026. Red Hat acknowledged the CVE in their security advisory tracker. Community discussion on Mastodon and Bluesky highlighted the severity of the prototype pollution chain leading to RCE.