CVE-2026-32723: Nyariv Sandboxjs

Medium severity, CVSS 4.7. EPSS: 0.1% chance of exploitation in the next 30 days.

SandboxJS is a JavaScript sandboxing library. Prior to 0.8.35, SandboxJS timers have an execution-quota bypass. A global tick state (`currentTicks.current`) is shared between sandboxes. Timer string handlers are compiled at execution time using that global tick state rather than the scheduling sandbox's tick object. In multi-tenant / concurrent sandbox scenarios, another sandbox can overwrite `currentTicks.current` between scheduling and execution, causing the timer callback to run under a different sandbox's tick budget and bypass the original sandbox's execution quota/watchdog. Version 0.8.35 fixes this issue.

Affected products

• Nyariv Sandboxjs: before 0.8.35 (fixed in 0.8.35)

Published 2026-03-18. Last modified 2026-06-17.