CVE-2026-43898
CVE-2026-43898 · SandboxJS: Sandbox escape via Function.caller leakage of internal call op
This page contains facts from public vulnerability sources. Check the original advisory before updating.
SandboxJS is a JavaScript sandboxing library. Prior to 0.9.6, sandbox-defined functions expose Function.caller, allowing sandboxed code to recover the internal LispType.Call runtime callback. That callback can then be invoked with attacker-controlled fake context and obj values to extract blocked host statics, recover the real host Function constructor, and execute arbitrary host JavaScript. This vulnerability is fixed in 0.9.6.
CVSS 10.0 · Critical · EPSS 0.5% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
sandboxjs
- Versions
- < 0.9.6: Affected
No fix published
@nyariv/sandboxjs npm
- Affected ranges
- SEMVER: < 0.9.6
Update to 0.9.6