What’s Vulnerable › Products

nyariv SandboxJS vulnerabilities

14 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 14 published in the last 12 months.

Check whether your nyariv SandboxJS version is affected

Latest nyariv SandboxJS vulnerabilities

• CVE-2026-43898 — SandboxJS: Sandbox escape via Function.caller leakage of internal call op (CVSS 10.0)
• CVE-2026-34217 — SandboxJS has a Sandbox Escape via Prop Object Leak in New Handler (CVSS 7.2)
• CVE-2026-34211 — SandboxJS: Stack overflow DoS via deeply nested expressions in recursive descent parser (CVSS 7.5)
• CVE-2026-34208 — SandboxJS: Sandbox integrity escape (CVSS 10.0)
• CVE-2026-32723 — SandboxJS timers have an execution-quota bypass (cross-sandbox currentTicks race) (CVSS 4.7)
• CVE-2026-26954 — SandboxJS has a Sandbox Escape (CVSS 10.0)
• CVE-2026-25881 — @nyariv/sandboxjs has host prototype pollution from sandbox via array intermediary (sandbox escape) (CVSS 10.0)
• CVE-2026-25641 — SandboxJS has a sandbox escape via TOCTOU bug on keys in property accesses (CVSS 9.0)
• CVE-2026-25587 — SandboxJS has a Sandbox Escape (CVSS 10.0)
• CVE-2026-25586 — SandboxJS has a Sandbox Escape via Prototype Whitelist Bypass and Host Prototype Pollution (CVSS 10.0)
• CVE-2026-25520 — SandboxJS has a Sandbox Escape (CVSS 10.0)
• CVE-2026-25142 — SandboxJS Prototype Pollution -> Sandbox Escape -> RCE (CVSS 10.0)
• CVE-2026-23830 — SandboxJS has Sandbox Escape via Unprotected AsyncFunction Constructor (CVSS 10.0)
• CVE-2025-34146 — nyariv sandboxjs 0.8.23 Prototype Pollution Sandbox Escape DoS (CVSS 7.0)