CVE-2026-25641: SandboxJS Auth Bypass Vulnerability

CVE-2026-25641 Overview

CVE-2026-25641 is a sandbox escape vulnerability in SandboxJS, a JavaScript sandboxing library used to execute untrusted code in a controlled environment. Prior to version 0.8.29, a critical flaw exists due to a mismatch between the key on which validation is performed and the key used for accessing properties. This Time-of-Check Time-of-Use (TOCTOU) race condition allows attackers to completely bypass sandbox restrictions and execute arbitrary code.

The vulnerability stems from the fact that although the key used in property accesses is annotated as a string type, this constraint is never enforced at runtime. Attackers can exploit this by passing malicious objects that coerce to different string values depending on when they are evaluated—one value during key sanitization via hasOwnProperty(key) and a different value during the actual property access.

Critical Impact

This vulnerability allows complete sandbox escape, enabling attackers to execute arbitrary code outside the sandboxed environment. With a network attack vector requiring no authentication or user interaction, any application using vulnerable versions of SandboxJS to isolate untrusted JavaScript code is at risk of full system compromise.

Affected Products

• SandboxJS versions prior to 0.8.29
• Applications using SandboxJS for JavaScript code isolation
• Node.js and browser environments utilizing the vulnerable library

Discovery Timeline

• 2026-02-06 - CVE-2026-25641 published to NVD
• 2026-02-06 - Last updated in NVD database

Technical Details for CVE-2026-25641

Vulnerability Analysis

This vulnerability is classified as CWE-367 (Time-of-Check Time-of-Use Race Condition). The core issue lies in the executor module of SandboxJS where property access validation occurs separately from actual property access.

When the sandbox validates whether a property access is safe, it calls hasOwnProperty(key) to check if the key exists on a whitelist or is otherwise permitted. However, when the actual property access occurs moments later, the same key object is used. Since JavaScript allows objects to define custom toString() or Symbol.toPrimitive methods, an attacker can craft an object that returns different string values on consecutive coercions.

This TOCTOU gap means the validation check passes with a benign string value, but the subsequent property access uses a malicious value that grants access to restricted objects like Function, eval, or the global this context.

Root Cause

The root cause is insufficient type enforcement on property access keys within the sandbox executor. The TypeScript type annotation indicates the key should be a string, but JavaScript's duck typing allows any object with string coercion methods to be passed. The fix introduces proper validation by ensuring keys are converted to their string representation once and reused, preventing coercion attacks.

The security patch introduces changes to LocalScope handling in SandboxExec.ts and adds reserved word validation in parser.ts to prevent access to dangerous identifiers.

Attack Vector

Attackers can exploit this vulnerability remotely through any application that accepts and executes user-provided JavaScript code within a SandboxJS sandbox. The attack requires no authentication or user interaction, making it trivially exploitable in environments where untrusted code execution is a feature.

An attacker crafts a JavaScript payload containing an object with a malicious toString() method that returns different values on consecutive calls. When passed as a property key, it bypasses the safety check and accesses restricted properties.

// Security patch in src/SandboxExec.ts - importing LocalScope for proper scoping
   IOptionParams,
   IOptions,
   IScope,
+  LocalScope,
   replacementCallback,
   SandboxGlobal,
   SubscriptionSubject,

Source: GitHub Commit Changes

// Security patch in src/parser.ts - adding reserved word validation
 import unraw from './unraw.js';
-import { CodeString, isLisp, LispType } from './utils.js';
+import { CodeString, isLisp, LispType, reservedWords } from './utils.js';
 
 export type DefineLisp<
   op extends LispType,

Source: GitHub Commit Changes

The fix hardens the sandbox by importing reservedWords for validation and modifying scope handling through LocalScope to prevent bypass attacks.

Detection Methods for CVE-2026-25641

Indicators of Compromise

• Unexpected process spawning or file system access from Node.js applications using SandboxJS
• Unusual network connections originating from sandboxed code execution contexts
• Error logs showing attempts to access restricted JavaScript globals like Function, constructor, or __proto__
• Memory access patterns indicating prototype pollution attempts

Detection Strategies

• Implement application-level logging for all code submitted to SandboxJS execution contexts
• Monitor for objects with custom toString() or Symbol.toPrimitive methods in sandbox inputs
• Deploy runtime application self-protection (RASP) to detect sandbox escape attempts
• Use SentinelOne Singularity to monitor for anomalous behavior from JavaScript runtime processes

Monitoring Recommendations

• Enable verbose logging in applications using SandboxJS to capture execution context details
• Monitor npm audit and dependency scanning tools for SandboxJS version alerts
• Implement centralized logging for all sandbox execution events with input/output correlation
• Configure alerting on unexpected system calls from Node.js or browser-based JavaScript engines

How to Mitigate CVE-2026-25641

Immediate Actions Required

• Upgrade SandboxJS to version 0.8.29 or later immediately
• Audit all applications using SandboxJS to identify vulnerable deployments
• Temporarily disable untrusted code execution features if immediate patching is not possible
• Review application logs for potential exploitation attempts prior to patching

Patch Information

The vulnerability is fixed in SandboxJS version 0.8.29. The security patch addresses the TOCTOU condition by ensuring proper key type validation and introducing reserved word checks in the parser. The fix is available via npm and the GitHub repository.

For detailed technical information about the vulnerability, consult the GitHub Security Advisory.

Workarounds

• Disable user-provided code execution features until the patch can be applied
• Implement additional input validation to reject objects with custom coercion methods before passing to the sandbox
• Use process isolation (separate Node.js processes or containers) as a defense-in-depth measure
• Apply strict Content Security Policy headers in browser environments to limit damage from potential escapes

# Upgrade SandboxJS to patched version
npm update sandboxjs@0.8.29

# Verify installed version
npm list sandboxjs

# Run security audit to check for other vulnerabilities
npm audit