CVE-2026-23830: SandboxJS Sandbox Escape RCE Vulnerability

CVE-2026-23830 Overview

CVE-2026-23830 is a critical sandbox escape vulnerability in SandboxJS, a JavaScript sandboxing library. The vulnerability allows attackers to completely bypass sandbox restrictions by exploiting an incomplete isolation of function constructors, specifically AsyncFunction, GeneratorFunction, and AsyncGeneratorFunction. By accessing these non-isolated constructors through the .constructor property of async functions, attackers can execute arbitrary code outside the sandbox context, leading to Remote Code Execution (RCE) with full access to the host environment.

Critical Impact

Complete sandbox escape enabling Remote Code Execution in the host environment. Attackers can bypass all sandbox restrictions and execute arbitrary code with full host privileges.

Affected Products

• SandboxJS versions prior to 0.8.26

Discovery Timeline

• 2026-01-28 - CVE CVE-2026-23830 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2026-23830

Vulnerability Analysis

The vulnerability exists in SandboxJS's approach to sandboxing JavaScript code execution. The library attempts to create a secure execution environment by replacing the global Function constructor with a sandboxed version called SandboxFunction. This replacement is implemented in utils.ts through a mapping mechanism that intercepts Function lookups.

However, JavaScript has multiple function constructors beyond the global Function. The AsyncFunction, GeneratorFunction, and AsyncGeneratorFunction constructors are not exposed as global properties but can be accessed through the .constructor property of their respective function instances. For example, (async () => {}).constructor returns the native AsyncFunction constructor.

In executor.ts, when code running inside the sandbox accesses the .constructor property on an async function (which the sandbox permits creating), the executor retrieves the property value directly. Because AsyncFunction was not included in the safe-replacement map, the executor returns the actual native host AsyncFunction constructor instead of a sandboxed version.

Function constructors in JavaScript create functions that execute in the global scope. By obtaining the host AsyncFunction constructor, an attacker can instantiate a new async function that executes entirely outside the sandbox context, completely bypassing all security restrictions.

Root Cause

The root cause is incomplete isolation of JavaScript function constructors (CWE-94: Improper Control of Generation of Code). While the library correctly sandboxed the Function constructor, it failed to account for alternative function constructors (AsyncFunction, GeneratorFunction, AsyncGeneratorFunction) that are accessible via prototype chain navigation rather than global property access.

Attack Vector

The attack is network-accessible and requires no authentication or user interaction. An attacker can exploit this vulnerability by providing malicious JavaScript code to be executed within the SandboxJS sandbox. By accessing the .constructor property of an async function instance, the attacker obtains a reference to the native AsyncFunction constructor and uses it to create and execute code outside the sandbox.

The actual patch introduces sandboxed versions of these additional function constructors. The fix adds AsyncFunction import and creates corresponding sandboxed versions:

 import { IEvalContext } from './eval.js';
 import { Change, ExecReturn, executeTree, executeTreeAsync } from './executor.js';
 import {
+  AsyncFunction,
   createContext,
   IContext,
   IExecContext,

Source: GitHub Commit Details

The patch also adds the sandboxed async function handler in the eval context:

-import { createFunction, currentTicks } from './executor.js';
+import { createFunction, createFunctionAsync, currentTicks } from './executor.js';
 import parse, { lispifyFunction } from './parser.js';
 import { IExecContext, Ticks } from './utils.js';
 
 export interface IEvalContext {
   sandboxFunction: typeof sandboxFunction;
+  sandboxAsyncFunction: typeof sandboxAsyncFunction;
   sandboxedEval: typeof sandboxedEval;
   sandboxedSetTimeout: typeof sandboxedSetTimeout;
   sandboxedSetInterval: typeof sandboxedSetInterval;

Source: GitHub Commit Details

Detection Methods for CVE-2026-23830

Indicators of Compromise

• Unexpected code execution or process spawning from applications using SandboxJS
• Access attempts to .constructor properties on async functions within sandboxed code
• Unusual network connections or file system access from sandboxed JavaScript execution contexts

Detection Strategies

• Monitor application logs for suspicious JavaScript patterns accessing function constructors via prototype chains
• Implement code analysis to detect patterns like (async () => {}).constructor or similar constructor access attempts
• Deploy runtime application self-protection (RASP) to detect sandbox escape attempts

Monitoring Recommendations

• Enable verbose logging for applications utilizing SandboxJS sandboxing capabilities
• Monitor for unexpected privileged operations originating from JavaScript execution contexts
• Implement integrity monitoring for applications using SandboxJS to detect unauthorized modifications

How to Mitigate CVE-2026-23830

Immediate Actions Required

• Upgrade SandboxJS to version 0.8.26 or later immediately
• Audit applications using SandboxJS to identify exposure to untrusted JavaScript code
• Implement additional security layers around JavaScript execution contexts until patching is complete

Patch Information

The vulnerability is patched in SandboxJS version 0.8.26. The fix adds proper sandboxing for AsyncFunction, GeneratorFunction, and AsyncGeneratorFunction constructors, ensuring all function constructor access within the sandbox returns sandboxed versions. For detailed patch information, see the GitHub Security Advisory and the commit details.

Workarounds

• Avoid executing untrusted JavaScript code in SandboxJS until the patch is applied
• Implement pre-processing filters to detect and block constructor access patterns in input code
• Consider using additional isolation mechanisms such as Web Workers or separate process sandboxing as defense-in-depth

# Upgrade SandboxJS to patched version
npm update sandboxjs@0.8.26
# Or install specifically
npm install sandboxjs@^0.8.26