CVE-2026-25641: Nyariv Sandboxjs Auth Bypass Vulnerability

CVE-2026-25641 Overview

CVE-2026-25641 is a sandbox escape vulnerability in SandboxJS, a JavaScript sandboxing library maintained by nyariv. The flaw affects all versions prior to 0.8.29 and stems from a Time-of-Check Time-of-Use (TOCTOU) condition [CWE-367] between key validation and property access. Attackers can supply objects that coerce to different string values at different points in execution, bypassing the hasOwnProperty(key) allow-list check and reaching restricted properties on the host environment.

Critical Impact
A remote, unauthenticated attacker who can submit script content to a SandboxJS-protected runtime can escape the sandbox and read, modify, or execute code outside the intended isolation boundary.

Affected Products

nyariv/SandboxJS versions prior to 0.8.29
Node.js applications embedding SandboxJS for untrusted script evaluation
Browser-side applications that delegate user-supplied JavaScript to SandboxJS for isolation

Discovery Timeline

2026-02-06 - CVE-2026-25641 published to the National Vulnerability Database
2026-02-18 - Last updated in the NVD database

Technical Details for CVE-2026-25641

Vulnerability Analysis

SandboxJS enforces property access restrictions by validating each property key against an allow-list before the underlying access occurs. The sandbox calls hasOwnProperty(key) on a permitted-keys object to confirm the key is safe, then uses the same key variable for the actual property read or write.

The key parameter is typed as a string in TypeScript, but TypeScript types are erased at runtime. The executor never coerces or freezes the key before validation, so a caller can pass any object. When JavaScript implicitly converts the object to a string, it invokes the object's toString() or Symbol.toPrimitive method.

An attacker supplies a malicious object whose string conversion returns a benign, allow-listed name on the first call and a forbidden name such as constructor or __proto__ on the second call. The validation succeeds while the access reaches a restricted property, breaking the sandbox boundary.

Root Cause

The root cause is a classic TOCTOU pattern: the library treats a mutable, attacker-controlled object as a stable string. Because the same value is stringified twice without caching, the validation result and the access target diverge. The vulnerable logic resides in the property access path in src/executor.ts, which the maintainer fixed in commit 67cb186c41c78c51464f70405504e8ef0a6e43c3.

Attack Vector

Exploitation requires the attacker to deliver crafted JavaScript to an application that evaluates untrusted code through SandboxJS. The attacker constructs an object with a stateful toString() method, then uses it as a property key. The first invocation returns a safe key to satisfy hasOwnProperty. The second invocation returns a sensitive key such as constructor, granting access to the host realm's Function constructor and arbitrary code execution outside the sandbox.

The vulnerability mechanism is documented in the SandboxJS Security Advisory GHSA-7x3h-rm86-3342 and the upstream fix commit.

Detection Methods for CVE-2026-25641

Indicators of Compromise

Submitted scripts that define objects with custom toString() or Symbol.toPrimitive methods used as computed property keys
Runtime access attempts to forbidden identifiers such as constructor, prototype, __proto__, or Function originating from sandboxed code
Outbound network connections, file system writes, or process spawns initiated by a process whose only intended workload is sandboxed evaluation

Detection Strategies

Inventory all application dependencies and flag any version of nyariv/SandboxJS earlier than 0.8.29 using software composition analysis tooling
Enable Node.js audit logging for child process creation, dynamic eval, and Function constructor invocations in services that host SandboxJS
Compare submitted script AST patterns against rules that detect non-string objects used in computed member expressions

Monitoring Recommendations

Forward Node.js process telemetry and SandboxJS host application logs to a centralized analytics platform for correlation
Alert on unexpected file, network, or process activity from accounts that run script-evaluation workloads
Track dependency manifests in CI pipelines and break the build when vulnerable SandboxJS versions are introduced

How to Mitigate CVE-2026-25641

Immediate Actions Required

Upgrade nyariv/SandboxJS to version 0.8.29 or later across all Node.js services and front-end bundles
Audit application code that passes user-supplied identifiers into SandboxJS to confirm keys are coerced to primitive strings before reaching the library
Restrict the privileges of the host process running SandboxJS so a sandbox escape cannot reach sensitive credentials, file paths, or network resources

Patch Information

The maintainer fixed the issue in SandboxJS 0.8.29 via commit 67cb186c41c78c51464f70405504e8ef0a6e43c3. The fix enforces that property keys are converted to primitive strings before validation and access, ensuring both operations use identical values. Refer to the GitHub commit for the exact change.

Workarounds

Wrap calls into SandboxJS with a pre-processing step that explicitly invokes String(key) on every computed key before passing it to the library
Run the SandboxJS host process inside an OS-level sandbox such as a restricted container, seccomp profile, or unprivileged user account
Disable execution of untrusted scripts until the upgrade to 0.8.29 is deployed

bash

# Upgrade SandboxJS to the patched release
npm install @nyariv/sandboxjs@^0.8.29

# Verify resolved version in the dependency tree
npm ls @nyariv/sandboxjs

# Audit the project for remaining vulnerable transitive copies
npm audit --production