CVE-2026-34217: 
JavaScript vulnerability analysis and mitigation

CVE-2026-34217 is a scope modification (sandbox escape) vulnerability in the @nyariv/sandboxjs npm package, versions 0.8.35 and below, titled "Sandbox Escape via Prop Object Leak in New Handler." It allows untrusted sandboxed code to leak internal interpreter Prop objects through the new operator, exposing sandbox scope objects — including references to host globals — to untrusted code. The vulnerability was published on April 3, 2026, with a patch released in version 0.8.36. It carries a CVSS v3.1 base score of 7.2 (High) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory).

The root cause is classified as CWE-668 (Exposure of Resource to Wrong Sphere). The vulnerability resides in the LispType.New operator handler in src/executor.ts (lines 1275–1280): unlike the LispType.Call handler, the New handler neither passes constructor arguments through valueOrProp() to strip internal Prop wrappers, nor sanitizes the return value via getGlobalProp() or sanitizeArray(). When sandboxed code accesses a variable (e.g., isNaN), the interpreter wraps it in a Prop object whose context field is a direct reference to scope.allVars — the same object as options.globals containing real host JavaScript objects. By passing this raw Prop as a constructor argument via new Constructor(someVariable), an attacker can read arg.context inside the constructor and obtain a direct reference to the sandbox's global scope object, enabling scope modification. A public proof-of-concept exploit is available in the security advisory (GitHub Advisory).

Successful exploitation allows an attacker controlling code executed inside the sandbox to leak internal interpreter scope objects and modify scope variables above the attacker's normally accessible scope level. This can expose sensitive data stored in sandbox scope objects (e.g., host globals, application-injected variables), and allow unauthorized modification of sandbox-internal state. Notably, code evaluation remains sandboxed and JavaScript prototypes remain protected, so the impact is limited to confidentiality and integrity of scope data rather than full host code execution (GitHub Advisory).

A public proof-of-concept exploit script (exploit.mjs) is available in the GitHub security advisory, demonstrating the full sandbox escape in a minimal Node.js environment. The attack requires no authentication, no user interaction, and works with the default sandbox configuration — the only prerequisite is that the host application uses the standard sandbox.compile(code)({}).run() pattern. The EPSS score is approximately 0.07–0.10% (27th percentile), and there is no evidence of in-the-wild exploitation or CISA KEV catalog listing at this time (GitHub Advisory).

1. Setup: Install the vulnerable package in a Node.js ESM project: npm install @nyariv/sandboxjs@0.8.35.
2. Craft malicious sandboxed code: Write a constructor function inside the sandbox that captures the context property of its argument — a raw Prop object leaked by the unsanitized New handler:

   function E(a) { this.scope = a.context }
   return new E(isNaN)

3. Execute via standard API: Compile and run the payload using the documented sandbox API:

   import pkg from '@nyariv/sandboxjs';
   const Sandbox = pkg.default || pkg;
   const sandbox = new Sandbox();
   const {scope} = sandbox.compile(`function E(a){this.scope=a.context}return new E(isNaN)`)({}).run();

4. Obtain scope reference: The returned object's scope property is now a direct reference to scope.allVars (i.e., options.globals), containing real host JavaScript objects.
5. Modify or exfiltrate scope data: Use the leaked reference to read or overwrite variables in the sandbox's global scope, potentially exposing sensitive application data injected into the sandbox context (GitHub Advisory).

• Logs: Node.js application logs showing unexpected return values from sandbox.compile(...).run() calls containing objects with internal scope or context properties not expected by the application.
• File System: Presence of files named exploit.mjs or similar PoC scripts in project directories; unexpected @nyariv/sandboxjs versions (≤ 0.8.35) in node_modules or package-lock.json.
• Process Behavior: Unexpected access or mutation of global JavaScript objects (e.g., Array, Object, Function) within a sandboxed execution context; sandbox returning objects with Prop-like structure ({ context, prop, isConst, isGlobal, isVariable }) to the host application.

Upgrade @nyariv/sandboxjs to version 0.8.36 or later, which adds valueOrProp() sanitization to constructor arguments and sanitizes return values in the New handler. If immediate patching is not possible, restrict the types of untrusted code permitted to use the new operator within the sandbox, and implement additional isolation layers for sensitive data that should not be accessible from sandboxed execution contexts. As a defense-in-depth measure, consider freezing the globals object (Object.freeze(options.globals)) to prevent mutation via any leaked references (GitHub Advisory).