CVE-2026-25641: 
JavaScript vulnerability analysis and mitigation

CVE-2026-25641 is a sandbox escape vulnerability in SandboxJS (@nyariv/sandboxjs), a JavaScript sandboxing library for Node.js. The flaw allows attackers to bypass sandbox key validation and achieve remote code execution by exploiting a mismatch between the key used during property access validation and the key used for the actual property access. All versions up to and including 0.8.28 are affected; the issue was disclosed and patched on February 5, 2026, with the fix released in version 0.8.29. The GitHub Advisory Database rates this Critical with a CVSS v3.1 base score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), while Feedly's aggregated score is 9.0 (High) (Github Advisory, GHSA Advisory).

The root cause is a Time-of-Check Time-of-Use (TOCTOU) race condition (CWE-367) combined with improper neutralization of special elements (CWE-74) in the property access handler within src/executor.ts at line 304. The LispType.Prop operation accepts a property key typed as string, but this type annotation is never enforced at runtime. An attacker can craft a malicious object with a custom toString() method that returns one string value (e.g., "x") when the key is checked via hasOwnProperty(key), and a different, dangerous value (e.g., "__proto__") when the key is subsequently used for the actual property access. This allows the attacker to bypass sandbox restrictions and access prototype properties that should be blocked. A public proof-of-concept exploit is included in the advisory, demonstrating how __proto__ access can be leveraged to obtain a reference to Function.constructor and execute arbitrary system commands via child_process.execSync (Github Advisory, GHSA Advisory).

Successful exploitation results in a complete sandbox escape, enabling an attacker who can submit code for execution within the SandboxJS environment to achieve full remote code execution on the host system. The impact spans all three security dimensions: high confidentiality impact (arbitrary data disclosure), high integrity impact (unauthorized file system or process modifications), and high availability impact (service disruption or system takeover). Because the scope is changed, the compromise extends beyond the sandboxed component to the underlying host, enabling lateral movement, data exfiltration, or deployment of malware (Github Advisory, GHSA Advisory).

A working proof-of-concept exploit is publicly available in the GitHub Security Advisory (GHSA-7x3h-rm86-3342), demonstrating full sandbox escape and OS command execution with no privileges or user interaction required. The EPSS score is approximately 0.026% (8th percentile), indicating a currently low but non-negligible probability of exploitation in the wild. As of the time of disclosure, there is no confirmed evidence of active in-the-wild exploitation, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported (Github Advisory, GHSA Advisory).

1. Identify a target: Locate an application that accepts user-supplied JavaScript code and executes it within a SandboxJS (@nyariv/sandboxjs) instance running version ≤ 0.8.28.
2. Craft a malicious property key object: Create an object with a custom toString() method that returns a benign property name (e.g., "x") on the first call (during hasOwnProperty validation) and a restricted property name (e.g., "__proto__") on subsequent calls, using a counter variable to track invocations.
3. Trigger the TOCTOU bypass: Use the malicious object as a computed property key in a bracket-notation property access (e.g., a[nastyProp]). The sandbox validates the key as "x" (safe), but accesses a["__proto__"] (the Map prototype) during the actual property lookup.
4. Obtain a reference to a dangerous function: Through the prototype reference, overwrite or access a method (e.g., set mapProt.has = isFinite) to obtain a reference to a non-sandboxed built-in function.
5. Access Function.constructor: Use the obtained reference's .constructor property to get the native Function constructor, which is not subject to sandbox restrictions.
6. Execute arbitrary OS commands: Invoke Function.constructor with a payload string such as "return process.getBuiltinModule('child_process').execSync('ls -lah').toString()" to execute arbitrary system commands on the host (GHSA Advisory, Github Advisory).

• Process: Unexpected child processes spawned by the Node.js process running SandboxJS, such as sh, bash, cmd.exe, or utilities like ls, whoami, curl, or wget, particularly if the parent process is a web server or API handler.
• Logs: Application logs showing execution of user-supplied code strings containing patterns like __proto__, getBuiltinModule, child_process, execSync, or Function.constructor; Node.js unhandled exception logs referencing executor.ts or sandbox internals.
• Network: Unexpected outbound network connections from the Node.js server process to external IPs, especially on non-standard ports, following user code submission events.
• File System: New or modified files in the application directory or system temp directories created by the Node.js process; presence of web shells, reverse shell scripts, or unauthorized cron jobs created under the application's service account.

The vendor has released a patch in SandboxJS version 0.8.29, which enforces string type validation on property access keys and hardens the sandbox against code execution bypasses (commit 67cb186). All users running @nyariv/sandboxjs version 0.8.28 or earlier should upgrade immediately via npm install @nyariv/sandboxjs@0.8.29 or later. If immediate patching is not feasible, consider disabling or isolating any functionality that allows untrusted users to submit code for execution within SandboxJS until the patch can be applied (GHSA Advisory, Patch Commit).

The vulnerability was reported by security researcher cristianstaicu and disclosed by the maintainer (nyariv) via GitHub's security advisory process on February 5, 2026. Security news outlets including The Hacker Wire and SecurityOnline.info covered the disclosure, with SecurityOnline noting it as part of a broader set of critical SandboxJS flaws with CVSS scores up to 10.0 (SecurityOnline, The Hacker Wire). The vulnerability was also referenced in CISA's weekly vulnerability bulletin and noted in PoC tracking resources (CISA Bulletin).