CVE-2026-32723: SandboxJS timers have an execution-quota bypass (cross-sandbox currentTicks race)

Severity: medium (CVSS 4.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-03-18 · updated 2026-06-17
Weakness: CWE-362

Description

SandboxJS is a JavaScript sandboxing library. Prior to 0.8.35, SandboxJS timers have an execution-quota bypass. A global tick state (`currentTicks.current`) is shared between sandboxes. Timer string handlers are compiled at execution time using that global tick state rather than the scheduling sandbox's tick object. In multi-tenant / concurrent sandbox scenarios, another sandbox can overwrite `currentTicks.current` between scheduling and execution, causing the timer callback to run under a different sandbox's tick budget and bypass the original sandbox's execution quota/watchdog. Version 0.8.35 fixes this issue.

Affected products

nyariv SandboxJS: before 0.8.35 — fixed in 0.8.35

How to fix

Upgrade to a fixed version: nyariv SandboxJS 0.8.35. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-32723 or the next vulnerability affects your stack