Exposure of Resource to Wrong Sphere Affecting @nyariv/sandboxjs package, versions <0.8.36
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-NYARIVSANDBOXJS-15909756
- published5 Apr 2026
- disclosed3 Apr 2026
- creditchawdamrunal
Introduced: 3 Apr 2026
NewCVE-2026-34217 (opens in a new tab)How to fix?
Upgrade @nyariv/sandboxjs to version 0.8.36 or higher.
Overview
@nyariv/sandboxjs is a Javascript sandboxing library.
Affected versions of this package are vulnerable to Exposure of Resource to Wrong Sphere in the New handler due to missing sanitization of both constructor arguments and return values. An attacker can access and modify internal interpreter objects, including scope variables outside the intended sandbox, by passing specially crafted arguments that leak references to protected objects. This is only exploitable if the host application reads the return value from the sandbox execution, which is the standard and documented usage pattern.