CVE-2026-25587: Nyariv Sandboxjs RCE Vulnerability

CVE-2026-25587 Overview

CVE-2026-25587 is a sandbox escape vulnerability in SandboxJS, a JavaScript sandboxing library maintained by nyariv. Versions prior to 0.8.29 include Map in the SAFE_PROTOTYPES allowlist, exposing Map.prototype to sandboxed code. Attackers can overwrite Map.prototype.has to break out of the sandbox and execute arbitrary code in the host context. The flaw is categorized under [CWE-94] (Improper Control of Generation of Code) and was fixed in version 0.8.29.

Critical Impact
Untrusted JavaScript executed inside SandboxJS can escape the sandbox and run with the privileges of the host application, compromising confidentiality, integrity, and availability.

Affected Products

nyariv/SandboxJS versions prior to 0.8.29
Node.js applications embedding SandboxJS for untrusted script execution
Browser-based applications relying on SandboxJS for client-side isolation

Discovery Timeline

2026-02-06 - CVE-2026-25587 published to NVD
2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-25587

Vulnerability Analysis

SandboxJS isolates untrusted JavaScript by restricting access to dangerous globals and prototypes. The library maintains a SAFE_PROTOTYPES set listing prototypes that sandboxed code can reach. Prior to 0.8.29, Map was included in this allowlist. Because Map.prototype was reachable from inside the sandbox, sandboxed code could mutate methods on that prototype, including Map.prototype.has. When host code outside the sandbox subsequently invoked Map.prototype.has on a Map instance, the attacker-controlled replacement executed in the host context, defeating isolation.

This pattern is a classic prototype pollution leading to sandbox escape. The exploit requires no authentication, no user interaction, and operates over the network when the host application accepts untrusted scripts.

Root Cause

The root cause is the inclusion of Map in SAFE_PROTOTYPES. Sandboxing libraries must either freeze exposed prototypes or proxy them. SandboxJS did neither for Map.prototype, allowing writes to its methods to persist and influence host execution.

Attack Vector

An attacker supplies JavaScript to a host that evaluates it through SandboxJS. The script reassigns Map.prototype.has to a function that performs privileged operations. When the host or any downstream library calls .has() on any Map instance, the malicious function executes outside the sandbox. The attack vector is network-accessible whenever the host application accepts user-provided scripts, expressions, or templates.

No proof-of-concept exploit code is published in the referenced advisory. See the GitHub Security Advisory GHSA-66h4-qj4x-38xp for the maintainer's technical description.

Detection Methods for CVE-2026-25587

Indicators of Compromise

Sandboxed scripts assigning to Map.prototype.has or other Map.prototype members
Unexpected host-side exceptions or behavior changes when invoking Map.prototype methods
Outbound network calls or file system access originating from processes that should be sandboxed

Detection Strategies

Inventory all Node.js and front-end services that depend on nyariv/SandboxJS and flag any version below 0.8.29 using software composition analysis.
Add static analysis rules to identify writes to built-in prototypes (Map.prototype, Set.prototype, Array.prototype) inside any code path that originates from untrusted input.
Review application logs for runtime errors involving Map.prototype.has or other Map operations that correlate with untrusted script execution.

Monitoring Recommendations

Monitor process behavior of services that execute untrusted JavaScript for unexpected child processes, file writes, or network connections.
Track dependency manifests (package.json, package-lock.json) for downgrades or pinned versions of SandboxJS below 0.8.29.
Alert on any deployment artifact that bundles a SandboxJS version listed in the GitHub Security Advisory.

How to Mitigate CVE-2026-25587

Immediate Actions Required

Upgrade nyariv/SandboxJS to version 0.8.29 or later across all production and development environments.
Audit all entry points that pass user-controlled strings to SandboxJS and restrict access where feasible.
Rotate any secrets that were accessible to the host process if untrusted script execution occurred prior to patching.

Patch Information

The maintainer resolved the issue in commit 67cb186c41c78c51464f70405504e8ef0a6e43c3, released as version 0.8.29. The fix removes Map from SAFE_PROTOTYPES so its prototype is no longer reachable from sandboxed code. Refer to the GitHub Security Advisory GHSA-66h4-qj4x-38xp for full release notes.

Workarounds

If immediate upgrade is not possible, refuse to evaluate untrusted scripts that reference Map or Map.prototype.
Wrap host-side Map usage so that calls bypass Map.prototype.has, for example by invoking the original method captured at process startup.
Run the embedding service in a least-privilege container or Node.js worker with no filesystem or network egress to limit blast radius.

bash

# Upgrade SandboxJS to the patched release
npm install @nyariv/sandboxjs@0.8.29

# Verify the installed version
npm ls @nyariv/sandboxjs