CVE-2026-25587
📋 TL;DR
CVE-2026-25587 is a critical sandbox escape vulnerability in SandboxJS library versions before 0.8.29. Attackers can overwrite Map.prototype.has to break out of the JavaScript sandbox and execute arbitrary code. This affects any application using vulnerable SandboxJS versions for JavaScript isolation.
💻 Affected Systems
- SandboxJS
📦 What is this software?
Sandboxjs by Nyariv
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the host system where SandboxJS runs, allowing remote code execution, data theft, and lateral movement.
Likely Case
Arbitrary code execution within the application context, potentially leading to data exposure and privilege escalation.
If Mitigated
Limited impact if sandboxed code has minimal privileges and runs in isolated environments.
🎯 Exploit Status
The advisory includes technical details that make exploitation straightforward for attackers with JavaScript knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.8.29
Vendor Advisory: https://github.com/nyariv/SandboxJS/security/advisories/GHSA-66h4-qj4x-38xp
Restart Required: Yes
Instructions:
1. Update SandboxJS to version 0.8.29 or later. 2. Update package.json to specify 'sandboxjs': '>=0.8.29'. 3. Run npm update or yarn upgrade. 4. Restart your application.
🔧 Temporary Workarounds
Remove Map from SAFE_PROTOTYPES
allManually modify SandboxJS source to remove Map from SAFE_PROTOTYPES array
Edit the SandboxJS source file and remove 'Map' from SAFE_PROTOTYPES array
🧯 If You Can't Patch
- Isolate SandboxJS instances in containers with minimal privileges
- Implement strict input validation and monitoring for sandbox escape attempts
🔍 How to Verify
Check if Vulnerable:
Check package.json or node_modules for SandboxJS version below 0.8.29Check Version:
npm list sandboxjs | grep sandboxjsVerify Fix Applied:
Verify SandboxJS version is 0.8.29 or higher and test sandbox functionality📡 Detection & Monitoring
Log Indicators:
- Unusual JavaScript execution patterns
- Sandbox escape attempts in application logs
Network Indicators:
- Unexpected outbound connections from sandboxed processes
SIEM Query:
source="application_logs" AND ("sandbox escape" OR "Map.prototype" OR "CVE-2026-25587")