CVE-2026-26954

PoC —

CVSS 3.1

10.0 critical

EPSS

<1%p44

Published

Mar 13, 2026 (Mar 13, 2026)

Modified

Jun 17, 2026

Description

SandboxJS is a JavaScript sandboxing library. Prior to 0.8.34, it is possible to obtain arrays containing Function, which allows escaping the sandbox. Given an array containing Function, and Object.fromEntries, it is possible to construct {[p]: Function} where p is any constructible property. This vulnerability is fixed in 0.8.34.

Vendors: nyariv
Products: sandboxjs
Weakness: CWE-94
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news0 stories

No ingested article mentions this CVE yet.