CVE-2026-32723: 
JavaScript vulnerability analysis and mitigation

CVE-2026-32723 is an execution-quota bypass vulnerability (cross-sandbox currentTicks race condition) in SandboxJS (@nyariv/sandboxjs), a JavaScript sandboxing library for Node.js. It affects all versions up to and including 0.8.34, with the fix introduced in version 0.8.35. The vulnerability was published by the maintainer on March 14, 2026, added to the GitHub Advisory Database on March 16, 2026, and published by NVD on March 18, 2026. It carries a CVSS v3.1 base score of 4.7 (Medium) and a CVSS v4.0 base score of 4.8 (Medium) (GitHub Advisory, SandboxJS Advisory).

The root cause is a race condition (CWE-362) involving a globally shared mutable state variable currentTicks.current in src/executor.ts, which is overwritten each time any sandbox executes (_execNoneRecurse sets currentTicks.current = ticks). In src/eval.ts, functions such as sandboxFunction and sandboxedEval resolve the tick budget using ticks || currentTicks.current at the time of compilation rather than capturing the scheduling sandbox's tick object at scheduling time. When sandboxedSetTimeout is used with a string handler, the handler is compiled when the timer fires — not when it is scheduled — meaning that if another sandbox runs between scheduling and execution, it overwrites currentTicks.current with its own (potentially unlimited) tick budget. The original sandbox's execution quota is therefore bypassed, allowing CPU-intensive code to run unchecked (GitHub Advisory, Patch Commit).

Successful exploitation allows an attacker controlling sandboxed code to bypass configured execution quotas and watchdog timers, enabling CPU-intensive loops or long-running computations to run without restriction. The primary impact is availability: resource exhaustion can degrade or deny service to the host Node.js process and co-tenant sandboxes sharing the same process, making this particularly dangerous in multi-tenant environments such as online code runners, plugin engines, and server-side scripting hosts. Confidentiality and integrity are not impacted; escalation to remote code execution or sandbox escape was tested and not observed (GitHub Advisory, SandboxJS Advisory).

A public proof-of-concept (PoC) JavaScript exploit is available in the GitHub Security Advisory, demonstrating the bypass with a standalone Node.js script using two concurrent Sandbox instances (SandboxJS Advisory). The EPSS score is approximately 0.014% (0th percentile), indicating a very low probability of exploitation in the wild within the next 30 days. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog (GitHub Advisory).

1. Identify a vulnerable target: Confirm the target application uses @nyariv/sandboxjs version ≤ 0.8.34 and runs multiple Sandbox instances concurrently in the same Node.js process (e.g., a multi-tenant code runner or plugin host).
2. Obtain sandboxed code execution: Gain the ability to submit JavaScript code that will be executed within a SandboxJS sandbox — for example, as a user of an online code execution platform.
3. Schedule a CPU-intensive string handler via setTimeout: In the attacker-controlled sandbox (sandboxA), schedule a heavy computation using a string-based setTimeout handler:

sandboxA.compile('setTimeout("let x=0; for (let i=0;i<200;i++){ x += i } globalThis.doneA = true;", 0);')().run();

4. Trigger another sandbox execution before the timer fires: Cause a second sandbox (sandboxB) to execute any code between the scheduling and the timer callback. This overwrites currentTicks.current with sandboxB's (unrestricted) tick budget:

sandboxB.compile('1+1')().run();

5. Observe quota bypass: When sandboxA's timer fires, it compiles the string handler using currentTicks.current (now pointing to sandboxB's ticks), bypassing sandboxA's executionQuota. The heavy loop completes without triggering the halt callback (haltedA: false, doneA: true).
6. Achieve DoS: Repeat with increasingly expensive computations to exhaust CPU resources of the host process, degrading or denying service to other tenants (SandboxJS Advisory).

• Logs: Node.js process logs showing abnormally long execution times or unresponsiveness in sandbox-hosting services; absence of expected sandbox halt/quota-exceeded log entries for computationally heavy submitted code.
• Process: Sustained high CPU utilization by the Node.js process hosting SandboxJS, particularly correlated with user-submitted code containing loops or heavy computation; the process failing to enforce execution quotas (no halt events fired).
• Application Behavior: Multi-tenant sandbox environments where one tenant's submitted code causes degraded performance or timeouts for other tenants; haltOnSandboxError callbacks not being triggered despite quota-exceeding code being submitted.

Upgrade @nyariv/sandboxjs to version 0.8.35 or later, which resolves the issue by removing the global currentTicks export and replacing all ticks || currentTicks.current references in eval.ts with context.ctx.ticks, ensuring each sandbox always uses its own tick budget (Patch Commit, GitHub Advisory). As a defense-in-depth workaround prior to patching, isolate each tenant's sandbox into a separate Node.js process to prevent cross-sandbox tick state contamination. Additionally, apply OS-level or container-level CPU limits (e.g., cgroups, ulimit) to bound the impact of any quota bypass.