CVE-2026-25587: 
JavaScript vulnerability analysis and mitigation

CVE-2026-25587 is a critical sandbox escape vulnerability in SandboxJS (@nyariv/sandboxjs), a JavaScript sandboxing library for Node.js. Because Map is included in SAFE_PROTOTYPES, an attacker can access Map.prototype directly and overwrite Map.prototype.has, breaking out of the sandbox and achieving remote code execution. All versions up to and including 0.8.28 are affected; the issue was fixed in version 0.8.29, published on February 5, 2026. It carries a CVSS v3.1 base score of 10.0 (Critical) (GitHub Advisory, Security Advisory).

The root cause is improper prototype isolation within the sandbox's allowlist (SAFE_PROTOTYPES). Because Map is whitelisted, sandboxed code can freely access Map.prototype and mutate its methods — specifically Map.prototype.has — replacing it with a trusted function like isFinite. Since isFinite is a native function, its .constructor property is Function, which can be invoked to construct and execute arbitrary code outside the sandbox context (CWE-94, CWE-74). The vulnerability is effectively a variant of CVE-2026-25142, which used __lookupGetter__ for the same effect; this variant exploits a bug in the sandbox's let variable handling that makes const the required declaration to access Map.prototype. No authentication or user interaction is required — any code path that passes untrusted input to sb.compile() is exploitable (GitHub Advisory, Security Advisory).

Successful exploitation results in complete host compromise: an attacker can execute arbitrary operating system commands in the context of the Node.js process running SandboxJS, with full impact to confidentiality, integrity, and availability. Because the scope is marked as Changed, the vulnerability crosses the security boundary of the sandbox into the host environment, enabling data exfiltration, file system manipulation, spawning reverse shells, and potential lateral movement within the network. Any application that uses SandboxJS to evaluate untrusted JavaScript — such as online code editors, plugin systems, or user-scripting platforms — is at risk (GitHub Advisory, Feedly).

A working proof-of-concept exploit is publicly available in the GitHub Security Advisory and requires no authentication, no privileges, and no user interaction (Security Advisory). As of the time of disclosure, there is no confirmed evidence of in-the-wild exploitation, and no threat actor attribution has been reported. The EPSS score is approximately 0.039% (12th percentile), indicating a currently low but non-negligible probability of exploitation in the near term. CVE-2026-25587 was referenced in a CISA vulnerability bulletin (SB26-040) for the week of February 2, 2026, though it has not been added to the CISA KEV catalog (CISA Bulletin).

1. Identify target: Locate a Node.js application that uses @nyariv/sandboxjs version ≤ 0.8.28 and accepts user-controlled JavaScript input passed to sb.compile() — such as an online code runner, plugin engine, or scripting interface.
2. Craft the payload: Construct a JavaScript snippet that uses const (not let, due to the sandbox's let implementation bug) to obtain a reference to Map.prototype, then overwrites Map.prototype.has with a trusted native function (isFinite):

const m = Map.prototype;
m.has = isFinite;
console.log(
  isFinite.constructor(
    "return process.getBuiltinModule('child_process').execSync('id').toString()",
  )(),
);

3. Submit the payload: Pass the crafted code to the vulnerable application's sandboxed execution endpoint (e.g., via HTTP POST to an API that calls sb.compile(payload)().run()).
4. Achieve RCE: The overwritten Map.prototype.has allows access to Function via isFinite.constructor, which is used to construct and execute arbitrary code outside the sandbox, running OS commands as the Node.js process user.
5. Post-exploitation: Use the RCE primitive to establish a reverse shell, exfiltrate sensitive data, or pivot to other internal systems (Security Advisory).

• Logs: Node.js application logs showing execution of sb.compile() with inputs containing Map.prototype, isFinite.constructor, getBuiltinModule, or child_process; unexpected output from execSync calls in application stdout/stderr.
• Process: Unusual child processes spawned by the Node.js process (e.g., sh, bash, cmd.exe, ls, id, whoami, curl, wget) that are not part of normal application behavior.
• Network: Unexpected outbound connections from the Node.js server process to external IPs, particularly on non-standard ports, which may indicate reverse shell activity or data exfiltration.
• File System: New or modified files in the application directory or /tmp created by the Node.js process user; presence of web shells or scripts not part of the original deployment.
• Application: Inputs to the sandboxed execution endpoint containing the strings Map.prototype, isFinite.constructor, getBuiltinModule, or child_process in request bodies or query parameters (Security Advisory).

The primary remediation is to upgrade @nyariv/sandboxjs to version 0.8.29 or later, which hardens the sandbox against prototype-based escape techniques by restricting access to prototype chains of whitelisted objects (Security Advisory, Patch Commit). For systems that cannot patch immediately, restrict network access to any service that exposes SandboxJS-based code execution, and avoid passing untrusted user input to sb.compile(). Audit all dependencies on @nyariv/sandboxjs versions prior to 0.8.29 across your codebase and CI/CD pipelines.

SecurityOnline.info covered this vulnerability as part of a broader report on four critical SandboxJS flaws with CVSS 10.0 scores, highlighting the risk of host takeover (SecurityOnline). The Hacker Wire published a dedicated article on the sandbox escape via Map.prototype overwrite and shared it on Mastodon and Bluesky, generating community discussion (The Hacker Wire). Purple Ops also featured the vulnerability in their "Hottest CVEs" series (Purple Ops). The vulnerability was discovered and reported by researcher c0rydoras (GitHub Advisory).