CVE-2026-34208: 
JavaScript vulnerability analysis and mitigation

CVE-2026-34208 is a sandbox integrity escape vulnerability in SandboxJS, a JavaScript sandboxing library for Node.js. It allows unauthenticated attackers to bypass global object write protections and mutate host runtime globals from within the sandbox, with mutations persisting across all sandbox instances in the same process. All versions prior to 0.8.36 (specifically confirmed on 0.8.35) are affected. The vulnerability was published on April 6, 2026, with a patch released in version 0.8.36. It carries a CVSS v3.1 base score of 10.0 (Critical) (GitHub Advisory, Red Hat CVE).

The root cause is a protection mechanism failure (CWE-693) combined with improperly controlled modification of dynamically-determined object attributes (CWE-915). SandboxJS correctly blocks direct assignment to global objects via an assignCheck guard that throws a SandboxAccessError when obj.isGlobal is true. However, the SandboxGlobal constructor function — which copies all keys from a provided object into this — remains reachable from sandbox code via this.constructor, since this in sandbox global scope resolves to a SandboxGlobal instance. Because Function.prototype.call is permitted through the generic call opcode path, an attacker can invoke this.constructor.call(target, attackerObject) to write arbitrary properties into any host global object (e.g., Math, JSON) without triggering the assignment guard. The attack requires no privileges and no user interaction, and is exploitable over the network in any application that executes untrusted code within a SandboxJS sandbox (GitHub Advisory).

Successful exploitation allows untrusted sandbox code to permanently mutate host-level global objects (e.g., overwriting Math.random) in a way that persists process-wide across all subsequent sandbox instances and host code execution. This breaks the isolation guarantee of the sandbox, enabling cross-tenant or cross-request state poisoning in multi-tenant applications. If host application logic uses mutated built-ins in sensitive sinks (e.g., passing a mutated property to execSync), the vulnerability can be chained into arbitrary command execution on the host system, resulting in full compromise of confidentiality, integrity, and availability (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, consisting of two complete, runnable Node.js scripts that demonstrate the bypass and command execution chain. The advisory credits researcher fancymalware for the discovery. As of the time of reporting, there is no evidence of in-the-wild exploitation. The EPSS score is 0.06% (low probability of near-term exploitation), and the vulnerability does not appear in the CISA KEV catalog. Qualys has added detection for this vulnerability (GitHub Advisory, Feedly).

1. Identify target: Locate a Node.js application that uses @nyariv/sandboxjs version 0.8.35 or earlier and accepts untrusted user-supplied code for execution within a sandbox instance.
2. Confirm sandbox version: Verify the installed version via npm list @nyariv/sandboxjs or by inspecting package.json/package-lock.json in the target application.
3. Craft bypass payload: Prepare a JavaScript payload that accesses the SandboxGlobal constructor via this.constructor and uses Function.prototype.call to write arbitrary properties into a target host global object:

   const SG = this.constructor;
   SG.call(Math, { random: () => 'pwned' });

4. Submit payload for execution: Deliver the payload through whatever interface the application exposes for sandbox code execution (e.g., an API endpoint, a user script runner, a template engine).
5. Verify host mutation: Confirm the sandbox boundary has been broken by checking that Math.random() in the host process now returns the attacker-controlled value ('pwned'), and that the mutation persists in fresh sandbox instances.
6. Chain to command execution (if applicable): If host application code passes a mutated global property to a sensitive sink such as execSync, escalate to arbitrary OS command execution:

   this.constructor.call(Math, { cmd: 'id' });
   // Host code then executes: execSync(Math.cmd)

   This results in execution of the attacker-specified OS command under the Node.js process's privileges (GitHub Advisory).

• Logs: Unexpected or anomalous output from sandbox execution logs where built-in function return values change (e.g., Math.random() returning a string instead of a float); Node.js process logs showing errors or unexpected behavior in code paths that rely on standard built-ins.
• Process: Unusual child processes spawned by the Node.js application process (e.g., sh, bash, id, whoami, curl) that are not part of normal application behavior, potentially indicating execSync or similar being called with attacker-controlled input.
• File System: Unexpected files written to disk by the Node.js process, particularly in world-writable directories or the application's working directory, if the attacker chains the escape to file write operations.
• Network: Outbound connections from the Node.js server process to unexpected external IP addresses or domains, which may indicate a reverse shell or data exfiltration following successful exploitation (GitHub Advisory).

The vendor has released a fix in SandboxJS version 0.8.36; all users should upgrade immediately via npm install @nyariv/sandboxjs@0.8.36 or by updating their package.json dependency. No configuration-based workaround is available for versions prior to 0.8.36 — the bypass is inherent to the constructor exposure in the library's design. Applications executing untrusted code should also consider defense-in-depth measures such as running the Node.js process in an isolated container or with reduced OS-level privileges (e.g., using seccomp, namespaces, or a dedicated low-privilege user) to limit the blast radius of any sandbox escape (GitHub Advisory).

The vulnerability received coverage from several security news outlets and community aggregators shortly after disclosure. Security Online Info published an article titled "SandboxJS Escape Vulnerability CVE-2026-34208: Host Poisoning" and later included it in an April 2026 vulnerability digest. The Hacker Wire and Yazoul.net also published technical write-ups on the sandbox escape. Community discussion appeared on Mastodon/Infosec.exchange, and the vulnerability was included in CISA's weekly vulnerability bulletin (SB26-103) for the week of April 6, 2026. Red Hat tracked the CVE in their security advisory database (Security Online Info, Red Hat CVE, CISA Bulletin).