@nyariv/sandboxjs 0.8.34

Direct Vulnerabilities

Known vulnerabilities in the @nyariv/sandboxjs package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Exposure of Resource to Wrong Sphere @nyariv/sandboxjs is a Javascript sandboxing library. Affected versions of this package are vulnerable to Exposure of Resource to Wrong Sphere in the `New` handler due to missing sanitization of both constructor arguments and return values. An attacker can access and modify internal interpreter objects, including scope variables outside the intended sandbox, by passing specially crafted arguments that leak references to protected objects. This is only exploitable if the host application reads the return value from the sandbox execution, which is the standard and documented usage pattern. How to fix Exposure of Resource to Wrong Sphere? Upgrade `@nyariv/sandboxjs` to version 0.8.36 or higher.	<0.8.36
C Improperly Controlled Modification of Dynamically-Determined Object Attributes @nyariv/sandboxjs is a Javascript sandboxing library. Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes through the `constructor` process. An attacker can modify host global objects and persist these changes across sandbox instances by invoking the exposed constructor with attacker-controlled payloads. This allows the attacker to inject arbitrary properties into shared global objects, potentially leading to the execution of malicious code or alteration of application logic when these mutated properties are later used by the host application. How to fix Improperly Controlled Modification of Dynamically-Determined Object Attributes? Upgrade `@nyariv/sandboxjs` to version 0.8.36 or higher.	<0.8.36
M Uncontrolled Recursion @nyariv/sandboxjs is a Javascript sandboxing library. Affected versions of this package are vulnerable to Uncontrolled Recursion via the `restOfExp` function and the recursive call chain involving `lispify` and `lispifyExpr`. An attacker can cause the process to crash by supplying deeply nested expressions that trigger unbounded recursion. How to fix Uncontrolled Recursion? Upgrade `@nyariv/sandboxjs` to version 0.8.36 or higher.	<0.8.36
L Race Condition @nyariv/sandboxjs is a Javascript sandboxing library. Affected versions of this package are vulnerable to Race Condition through the global `currentTicks.current` state shared between concurrent sandboxes. An attacker can consume excessive CPU resources and bypass execution quotas by manipulating the global tick state during timer handler execution in a multi-tenant environment. How to fix Race Condition? Upgrade `@nyariv/sandboxjs` to version 0.8.35 or higher.	<0.8.35

Vulnerability

Vulnerable Version

Exposure of Resource to Wrong Sphere

@nyariv/sandboxjs is a Javascript sandboxing library.

Affected versions of this package are vulnerable to Exposure of Resource to Wrong Sphere in the New handler due to missing sanitization of both constructor arguments and return values. An attacker can access and modify internal interpreter objects, including scope variables outside the intended sandbox, by passing specially crafted arguments that leak references to protected objects. This is only exploitable if the host application reads the return value from the sandbox execution, which is the standard and documented usage pattern.

How to fix Exposure of Resource to Wrong Sphere?

Upgrade @nyariv/sandboxjs to version 0.8.36 or higher.

<0.8.36

Improperly Controlled Modification of Dynamically-Determined Object Attributes

@nyariv/sandboxjs is a Javascript sandboxing library.

Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes through the constructor process. An attacker can modify host global objects and persist these changes across sandbox instances by invoking the exposed constructor with attacker-controlled payloads. This allows the attacker to inject arbitrary properties into shared global objects, potentially leading to the execution of malicious code or alteration of application logic when these mutated properties are later used by the host application.

How to fix Improperly Controlled Modification of Dynamically-Determined Object Attributes?

Upgrade @nyariv/sandboxjs to version 0.8.36 or higher.

<0.8.36

Uncontrolled Recursion

@nyariv/sandboxjs is a Javascript sandboxing library.

Affected versions of this package are vulnerable to Uncontrolled Recursion via the restOfExp function and the recursive call chain involving lispify and lispifyExpr. An attacker can cause the process to crash by supplying deeply nested expressions that trigger unbounded recursion.

How to fix Uncontrolled Recursion?

Upgrade @nyariv/sandboxjs to version 0.8.36 or higher.

<0.8.36

Race Condition

@nyariv/sandboxjs is a Javascript sandboxing library.

Affected versions of this package are vulnerable to Race Condition through the global currentTicks.current state shared between concurrent sandboxes. An attacker can consume excessive CPU resources and bypass execution quotas by manipulating the global tick state during timer handler execution in a multi-tenant environment.

How to fix Race Condition?

Upgrade @nyariv/sandboxjs to version 0.8.35 or higher.

<0.8.35

@nyariv/sandboxjs@0.8.34

Javascript sandboxing library.

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically