CVE-2026-26954: Nyariv Sandboxjs RCE Vulnerability

CVE-2026-26954 Overview

CVE-2026-26954 is a critical code injection vulnerability in SandboxJS, a JavaScript sandboxing library developed by Nyariv. Prior to version 0.8.34, the library contains a flaw that allows attackers to obtain arrays containing the Function constructor, enabling complete sandbox escape. By leveraging access to Function and Object.fromEntries, an attacker can construct arbitrary objects with executable properties, effectively bypassing all sandbox security controls and executing arbitrary JavaScript code in the host environment.

Critical Impact

Complete sandbox escape allowing arbitrary code execution in the host Node.js environment. Attackers can bypass all security restrictions implemented by the sandbox, potentially leading to full system compromise.

Affected Products

• Nyariv SandboxJS versions prior to 0.8.34
• Node.js applications utilizing vulnerable SandboxJS versions
• Web applications relying on SandboxJS for JavaScript code isolation

Discovery Timeline

• 2026-03-13 - CVE-2026-26954 published to NVD
• 2026-03-17 - Last updated in NVD database

Technical Details for CVE-2026-26954

Vulnerability Analysis

This vulnerability represents a fundamental sandbox escape flaw (CWE-94: Improper Control of Generation of Code) in SandboxJS. JavaScript sandboxing libraries must carefully control access to dangerous primitives like the Function constructor, which can be used to execute arbitrary code. In vulnerable versions of SandboxJS, certain code paths inadvertently expose arrays containing the Function constructor to sandboxed code.

Once an attacker obtains a reference to Function, they can combine it with Object.fromEntries to construct objects with arbitrary properties mapped to executable functions. This technique allows construction of {[p]: Function} where p is any constructible property, effectively granting the attacker the ability to define and execute arbitrary functions outside the sandbox context.

The scope of impact is significant—a successful exploit results in code execution in the parent Node.js environment with the same privileges as the host application, bypassing all intended security controls.

Root Cause

The root cause lies in insufficient isolation of built-in JavaScript objects and constructors within the sandbox environment. SandboxJS failed to properly sanitize or proxy arrays that could contain references to the Function constructor. The library's object inspection and property enumeration mechanisms allowed sandboxed code to access these privileged objects through indirect paths that were not adequately protected.

Attack Vector

The attack is network-accessible and requires no authentication or user interaction. An attacker who can supply JavaScript code to be executed within the SandboxJS environment can exploit this vulnerability. Common attack scenarios include:

1. User-provided code execution: Applications that allow users to write and execute custom JavaScript logic
2. Plugin/extension systems: Platforms that sandbox third-party code using SandboxJS
3. Template engines: Systems that evaluate user-controlled JavaScript expressions

The attacker leverages the ability to enumerate or access array contents containing Function, then uses Object.fromEntries to construct executable objects. This bypasses the sandbox boundary entirely, allowing arbitrary code execution in the host environment.

Detection Methods for CVE-2026-26954

Indicators of Compromise

• Unexpected process spawning or child process creation from Node.js applications using SandboxJS
• File system access patterns inconsistent with application behavior from sandboxed contexts
• Network connections initiated from within sandboxed execution contexts
• Evidence of Object.fromEntries usage combined with Function constructor access in application logs

Detection Strategies

• Implement dependency scanning to identify SandboxJS versions prior to 0.8.34 in your software supply chain
• Monitor application logs for sandbox escape attempts or unusual code execution patterns
• Deploy runtime application self-protection (RASP) solutions that can detect and block sandbox escape techniques
• Utilize static analysis tools to identify code patterns that may expose dangerous constructors to sandboxed environments

Monitoring Recommendations

• Enable verbose logging for SandboxJS execution contexts to capture potential escape attempts
• Implement behavioral monitoring for Node.js processes to detect privilege escalation from sandboxed code
• Set up alerts for any network or file system operations originating from sandboxed execution contexts
• Monitor for unusual memory access patterns that may indicate sandbox boundary violations

How to Mitigate CVE-2026-26954

Immediate Actions Required

• Upgrade SandboxJS to version 0.8.34 or later immediately
• Audit applications using SandboxJS to identify potential exposure to untrusted code execution
• Consider temporarily disabling user-provided code execution features until patching is complete
• Implement additional defense-in-depth measures such as process isolation or containerization for sandboxed code execution

Patch Information

The vulnerability is fixed in SandboxJS version 0.8.34. The patch addresses the improper exposure of Function constructor references within arrays accessible to sandboxed code. Users should update their dependencies immediately by modifying their package.json to require version 0.8.34 or later.

For detailed patch information, refer to the GitHub Security Advisory GHSA-6r9f-759j-hjgv.

Workarounds

• If immediate patching is not possible, restrict or disable features that allow execution of user-provided JavaScript code
• Implement additional process-level isolation using Node.js worker threads or separate processes for sandboxed code
• Apply strict input validation to limit the JavaScript constructs that can be executed within the sandbox
• Consider migrating to alternative sandboxing solutions such as isolated VM environments while awaiting patch deployment

# Update SandboxJS to patched version
npm update @nyariv/sandboxjs@0.8.34

# Verify installed version
npm list @nyariv/sandboxjs

# For yarn users
yarn upgrade @nyariv/sandboxjs@0.8.34