@nyariv/sandboxjs@0.8.26

@nyariv/sandboxjs is a Javascript sandboxing library.

Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes through the constructor process. An attacker can modify host global objects and persist these changes across sandbox instances by invoking the exposed constructor with attacker-controlled payloads. This allows the attacker to inject arbitrary properties into shared global objects, potentially leading to the execution of malicious code or alteration of application logic when these mutated properties are later used by the host application.

Upgrade @nyariv/sandboxjs to version 0.8.36 or higher.

@nyariv/sandboxjs is a Javascript sandboxing library.

Affected versions of this package are vulnerable to Uncontrolled Recursion via the restOfExp function and the recursive call chain involving lispify and lispifyExpr. An attacker can cause the process to crash by supplying deeply nested expressions that trigger unbounded recursion.

Upgrade @nyariv/sandboxjs to version 0.8.36 or higher.

@nyariv/sandboxjs is a Javascript sandboxing library.

Affected versions of this package are vulnerable to Race Condition through the global currentTicks.current state shared between concurrent sandboxes. An attacker can consume excessive CPU resources and bypass execution quotas by manipulating the global tick state during timer handler execution in a multi-tenant environment.

Upgrade @nyariv/sandboxjs to version 0.8.35 or higher.

@nyariv/sandboxjs is a Javascript sandboxing library.

Affected versions of this package are vulnerable to Arbitrary Code Injection via the executor module. An attacker can execute arbitrary code by crafting input that allows them get to arrays containing Function() and escape the intended sandbox restrictions by invoking system-level commands.

Upgrade @nyariv/sandboxjs to version 0.8.34 or higher.

@nyariv/sandboxjs is a Javascript sandboxing library.

Affected versions of this package are vulnerable to Prototype Pollution via the sandbox implements a protection mechanism using the isGlobal flag in the Prop class. An attacker can modify host built-in prototypes by laundering the isGlobal protection flag through array literal intermediaries, which allows persistent changes to host-side prototypes and may enable execution of arbitrary code by leveraging polluted properties in sensitive sinks.

Upgrade @nyariv/sandboxjs to version 0.8.31 or higher.

@nyariv/sandboxjs is a Javascript sandboxing library.

Affected versions of this package are vulnerable to Prototype Pollution due to unfiltered access to the Function constructor, via Array.prototype.at(). An attacker can execute arbitrary code on the underlying system by chaining calls to Object.values, Object.entries, and Array.prototype.at that bypass sanitization.

Upgrade @nyariv/sandboxjs to version 0.8.29 or higher.

@nyariv/sandboxjs is a Javascript sandboxing library.

Affected versions of this package are vulnerable to Prototype Pollution via prototypeAccess on a shadowed sandbox object's hasOwnProperty(). An attacker can execute arbitrary code on the underlying system by bypassing the prototype whiteliests.

Upgrade @nyariv/sandboxjs to version 0.8.29 or higher.

@nyariv/sandboxjs is a Javascript sandboxing library.

Affected versions of this package are vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition in addOps() and other methods in executor.ts, which do not enforce the type of property keys. An attacker can execute arbitrary code on the underlying system by supplying a malicious object that passes key sanitization and subsequently manipulates key coercion to use an unsafe type when the key is accessed.

Upgrade @nyariv/sandboxjs to version 0.8.29 or higher.

@nyariv/sandboxjs is a Javascript sandboxing library.

Affected versions of this package are vulnerable to Arbitrary Code Injection by overriding the Map.prototype.has() method. An attacker can execute arbitrary code on the underlying operating system because Map is included in SAFE_PROTOYPES.

Note: This is a remaining vulnerability that was not covered by the fix for CVE-2026-25142.

Upgrade @nyariv/sandboxjs to version 0.8.29 or higher.