CVE-2026-25881: 
JavaScript vulnerability analysis and mitigation

CVE-2026-25881 is a sandbox escape vulnerability in SandboxJS (@nyariv/sandboxjs), a JavaScript sandboxing library for Node.js, that allows sandboxed code to mutate host built-in prototypes via array literal intermediaries, potentially enabling remote code execution (RCE). All versions up to and including 0.8.30 are affected; the vulnerability was disclosed on February 8, 2026, and fixed in version 0.8.31. The CVSS v3.1 score is 9.0 (Critical) per the GitHub Advisory, while Feedly's data reflects a score of 10.0 based on a slightly different vector assessment (GitHub Advisory, SandboxJS Advisory).

The root cause (CWE-1321: Improperly Controlled Modification of Object Prototype Attributes) lies in how SandboxJS tracks the isGlobal protection flag in the Prop class. When a global prototype reference (e.g., Map.prototype, Set.prototype) is placed into an array literal and retrieved, the isGlobal taint is stripped by the valueOrProp() call in src/executor.ts (L559–L571) during array creation. This causes the protection check in src/utils.ts (if (prop.isGlobal) throw new SandboxError(...)) to be bypassed, allowing direct mutation of host built-in prototypes from within the sandbox. The attack requires no authentication or user interaction and is exploitable over the network against any application that executes untrusted JavaScript via SandboxJS (SandboxJS Advisory, GitHub Advisory).

Successful exploitation results in persistent host-side prototype pollution, breaking the sandbox isolation boundary and affecting all subsequent host-side JavaScript execution. In applications that pass polluted prototype properties to sensitive sinks — such as child_process.execSync(obj.cmd) — this escalates to full remote code execution with the privileges of the Node.js process. All three CIA pillars are fully compromised: confidentiality (data exfiltration), integrity (arbitrary command execution), and availability (process disruption or termination) (SandboxJS Advisory).

A proof-of-concept (PoC) exploit is publicly available in the GitHub Security Advisory, demonstrating prototype pollution, method overwriting (Set.prototype.has), and RCE via execSync. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.046–0.057% (18th percentile), indicating a currently low but non-negligible exploitation probability. The vulnerability is not listed in the CISA KEV catalog (GitHub Advisory, SandboxJS Advisory).

1. Identify target: Locate a Node.js application that uses @nyariv/sandboxjs version ≤ 0.8.30 to execute user-supplied or untrusted JavaScript code.
2. Craft malicious sandboxed code: Prepare a payload that places a global prototype reference into an array literal and retrieves it, bypassing the isGlobal taint check:

   const m = [Map.prototype][0];
   m.cmd = 'id';
   return 'done';

3. Submit payload: Deliver the crafted JavaScript to the application's sandbox execution endpoint (e.g., via HTTP request, API call, or any input that feeds into sandbox.compile(...).run()).
4. Trigger prototype pollution: The valueOrProp() call during array creation strips the isGlobal flag, allowing the assignment m.cmd = 'id' to mutate Map.prototype on the host.
5. Achieve RCE via gadget: If the host application subsequently calls a sensitive sink using a polluted property (e.g., execSync(obj.cmd) where obj is a new Map()), the attacker-controlled value is executed as a system command, yielding code execution under the Node.js process identity (SandboxJS Advisory).

• Logs: Unexpected or anomalous JavaScript code submitted to sandbox execution endpoints; Node.js application logs showing errors or unusual output from child_process calls.
• Process: Unusual child processes spawned by the Node.js process (e.g., sh, bash, id, whoami, curl, wget) that are not part of normal application behavior.
• File System: New or modified files created by the Node.js process in unexpected directories; web shells or scripts dropped by the application user account.
• Network: Outbound connections from the Node.js server to unknown external IPs, particularly following sandbox code execution events; unexpected DNS lookups initiated by the application process.
• Application Behavior: Unexpected mutations to built-in prototype methods (e.g., Set.prototype.has, Map.prototype properties) detectable via runtime integrity checks or prototype freezing audits (SandboxJS Advisory).

Upgrade @nyariv/sandboxjs to version 0.8.31 or later, which hardens the sandbox by preserving the isGlobal protection flag across array/object literal creation and adds hard blocks on writes to built-in prototypes. As a defense-in-depth measure, consider freezing built-in prototypes in the host process before running untrusted code (e.g., Object.freeze(Map.prototype)) — note this may break some consumers. Additionally, audit any application code for sensitive sinks that consume object properties (e.g., execSync(obj.cmd)) and ensure untrusted input cannot reach them (GitHub Patch, SandboxJS Advisory).

The vulnerability received coverage from several security news outlets including SecurityOnline, CyberSecurityNews, and ITSecurityNews, with articles highlighting the critical nature of the sandbox escape and the availability of a PoC. Social media posts on Mastodon and Bluesky from accounts such as @thehackerwire and @infosec.skyfleet.blue amplified awareness shortly after disclosure. The vulnerability was also included in The Hacker News' weekly security recap, indicating moderate industry attention. Red Hat tracked the CVE as well, suggesting potential downstream impact on Red Hat ecosystem packages (SecurityOnline, Red Hat).