Improperly Controlled Modification of Dynamically-Determined Object Attributes Affecting @nyariv/sandboxjs package, versions <0.8.36

@nyariv/sandboxjs is a Javascript sandboxing library.

Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes through the constructor process. An attacker can modify host global objects and persist these changes across sandbox instances by invoking the exposed constructor with attacker-controlled payloads. This allows the attacker to inject arbitrary properties into shared global objects, potentially leading to the execution of malicious code or alteration of application logic when these mutated properties are later used by the host application.

• GitHub Advisory
• GitHub Commit