CVE-2026-25142: Nyariv Sandboxjs

Critical severity, CVSS 10.0. EPSS: 1.2% chance of exploitation in the next 30 days.

SandboxJS is a JavaScript sandboxing library. Prior to 0.8.27, SanboxJS does not properly restrict __lookupGetter__ which can be used to obtain prototypes, which can be used for escaping the sandbox / remote code execution. This vulnerability is fixed in 0.8.27.

Affected products

• Nyariv Sandboxjs: before 0.8.27 (fixed in 0.8.27)

Published 2026-02-02. Last modified 2026-06-17.