CVE-2026-32723
CVE-2026-32723 · SandboxJS timers have an execution-quota bypass (cross-sandbox currentTicks race)
This page contains facts from public vulnerability sources. Check the original advisory before updating.
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.35, SandboxJS timers have an execution-quota bypass. A global tick state (`currentTicks.current`) is shared between sandboxes. Timer string handlers are compiled at execution time using that global tick state rather than the scheduling sandbox's tick object. In multi-tenant / concurrent sandbox scenarios, another sandbox can overwrite `currentTicks.current` between scheduling and execution, causing the timer callback to run under a different sandbox's tick budget and bypass the original sandbox's execution quota/watchdog. Version 0.8.35 fixes this issue.
CVSS 4.8 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
sandboxjs
- Versions
- < 0.8.35: Affected
No fix published
@nyariv/sandboxjs npm
- Affected ranges
- SEMVER: < 0.8.35
Update to 0.8.35