Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
14 results
May 28, 2026SandboxJS is a JavaScript sandboxing library.CVE-2026-43898 · Other software · nyariv · reported by GitHubCritical 10
SandboxJS is a JavaScript sandboxing library. Prior to 0.9.6, sandbox-defined functions expose Function.caller, allowing sandboxed code to recover the internal LispType.Call runtime callback. That callback can then be invoked with attacker-controlled fake context and obj values to extract blocked host statics, recover the real host Function constructor, and execute arbitrary host JavaScript. This vulnerability is fixed in 0.9.6.
- Product
- SandboxJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026SandboxJS is a JavaScript sandboxing library.CVE-2026-34217 · Other software · nyariv · reported by GitHubMedium 6.9
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, a scope modification vulnerability exists in @nyariv/sandboxjs. The vulnerability allows untrusted sandboxed code to leak internal interpreter objects through the new operator, exposing sandbox scope objects in the scope hierarchy to untrusted code; an unexpected and undesired exploit. While this could allow modifying scopes inside the sandbox, code evaluation remains sandboxed and prototypes remain protected throughout the execution. This vulnerability is fixed in 0.8.36.
- Product
- SandboxJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026SandboxJS is a JavaScript sandboxing library.CVE-2026-34211 · Other software · nyariv · reported by GitHubMedium 6.9
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, the @nyariv/sandboxjs parser contains unbounded recursion in the restOfExp function and the lispify/lispifyExpr call chain. An attacker can crash any Node.js process that parses untrusted input by supplying deeply nested expressions (e.g., ~2000 nested parentheses), causing a RangeError: Maximum call stack size exceeded that terminates the process. This vulnerability is fixed in 0.8.36.
- Product
- SandboxJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026SandboxJS is a JavaScript sandboxing library.CVE-2026-34208 · Other software · nyariv · reported by GitHubCritical 10
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, SandboxJS blocks direct assignment to global objects (for example Math.random = ...), but this protection can be bypassed through an exposed callable constructor path: this.constructor.call(target, attackerObject). Because this.constructor resolves to the internal SandboxGlobal function and Function.prototype.call is allowed, attacker code can write arbitrary properties into host global objects and persist those mutations across sandbox instances in the same process. This vulnerability is fixed in 0.8.36.
- Product
- SandboxJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2026SandboxJS is a JavaScript sandboxing library.CVE-2026-32723 · Other software · nyariv · reported by GitHubMedium 4.8
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.35, SandboxJS timers have an execution-quota bypass. A global tick state (`currentTicks.current`) is shared between sandboxes. Timer string handlers are compiled at execution time using that global tick state rather than the scheduling sandbox's tick object. In multi-tenant / concurrent sandbox scenarios, another sandbox can overwrite `currentTicks.current` between scheduling and execution, causing the timer callback to run under a different sandbox's tick budget and bypass the original sandbox's execution quota/watchdog. Version 0.8.35 fixes this issue.
- Product
- SandboxJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2026SandboxJS is a JavaScript sandboxing library.CVE-2026-26954 · Other software · nyariv · reported by GitHubCritical 10
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.34, it is possible to obtain arrays containing Function, which allows escaping the sandbox. Given an array containing Function, and Object.fromEntries, it is possible to construct {[p]: Function} where p is any constructible property. This vulnerability is fixed in 0.8.34.
- Product
- SandboxJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026SandboxJS is a JavaScript sandboxing library.CVE-2026-25881 · Other software · nyariv · reported by GitHubCritical 9
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.31, a sandbox escape vulnerability allows sandboxed code to mutate host built-in prototypes by laundering the isGlobal protection flag through array literal intermediaries. When a global prototype reference (e.g., Map.prototype, Set.prototype) is placed into an array and retrieved, the isGlobal taint is stripped, permitting direct prototype mutation from within the sandbox. This results in persistent host-side prototype pollution and may enable RCE in applications that use polluted properties in sensitive sinks (example gadget: execSync(obj.cmd)). This vulnerability is fixed in 0.8.31.
- Product
- SandboxJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026SandboxJS is a JavaScript sandboxing library.CVE-2026-25641 · Other software · nyariv · reported by GitHubCritical 10
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, there is a sandbox escape vulnerability due to a mismatch between the key on which the validation is performed and the key used for accessing properties. Even though the key used in property accesses is annotated as string, this is never enforced. So, attackers can pass malicious objects that coerce to different string values when used, e.g., one for the time the key is sanitized using hasOwnProperty(key) and a different one for when the key is used for the actual property access. This vulnerability is fixed in 0.8.29.
- Product
- SandboxJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026SandboxJS is a JavaScript sandboxing library.CVE-2026-25587 · Other software · nyariv · reported by GitHubCritical 10
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, as Map is in SAFE_PROTOYPES, it's prototype can be obtained via Map.prototype. By overwriting Map.prototype.has the sandbox can be escaped. This vulnerability is fixed in 0.8.29.
- Product
- SandboxJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026SandboxJS is a JavaScript sandboxing library.CVE-2026-25586 · Other software · nyariv · reported by GitHubCritical 10
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, a sandbox escape is possible by shadowing hasOwnProperty on a sandbox object, which disables prototype whitelist enforcement in the property-access path. This permits direct access to __proto__ and other blocked prototype properties, enabling host Object.prototype pollution and persistent cross-sandbox impact. This vulnerability is fixed in 0.8.29.
- Product
- SandboxJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026SandboxJS is a JavaScript sandboxing library.CVE-2026-25520 · Other software · nyariv · reported by GitHubCritical 10
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, The return values of functions aren't wrapped. Object.values/Object.entries can be used to get an Array containing the host's Function constructor, by using Array.prototype.at you can obtain the hosts Function constructor, which can be used to execute arbitrary code outside of the sandbox. This vulnerability is fixed in 0.8.29.
- Product
- SandboxJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2026SandboxJS is a JavaScript sandboxing library.CVE-2026-25142 · Other software · nyariv · reported by GitHubCritical 10
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.27, SanboxJS does not properly restrict __lookupGetter__ which can be used to obtain prototypes, which can be used for escaping the sandbox / remote code execution. This vulnerability is fixed in 0.8.27.
- Product
- SandboxJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026SandboxJS is a JavaScript sandboxing library.CVE-2026-23830 · Other software · nyariv · reported by GitHubCritical 10
SandboxJS is a JavaScript sandboxing library. Versions prior to 0.8.26 have a sandbox escape vulnerability due to `AsyncFunction` not being isolated in `SandboxFunction`. The library attempts to sandbox code execution by replacing the global `Function` constructor with a safe, sandboxed version (`SandboxFunction`). This is handled in `utils.ts` by mapping `Function` to `sandboxFunction` within a map used for lookups. However, before version 0.8.26, the library did not include mappings for `AsyncFunction`, `GeneratorFunction`, and `AsyncGeneratorFunction`. These constructors are not global properties but can be accessed via the `.constructor` property of an instance (e.g., `(async () => {}).constructor`). In `executor.ts`, property access is handled. When code running inside the sandbox accesses `.constructor` on an async function (which the sandbox allows creating), the `executor` retrieves the property value. Since `AsyncFunction` was not in the safe-replacement map, the `executor` returns the actual native host `AsyncFunction` constructor. Constructors for functions in JavaScript (like `Function`, `AsyncFunction`) create functions that execute in the global scope. By obtaining th
- Product
- SandboxJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2025A prototype pollution vulnerability exists in @nyariv/sandboxjs versions <= 0.8.23, allowing attackers to inject arbitrary properties into Object.prototype via CVE-2025-34146 · Other software · nyariv · reported by VulnCheckHigh 7
A prototype pollution vulnerability exists in @nyariv/sandboxjs versions <= 0.8.23, allowing attackers to inject arbitrary properties into Object.prototype via crafted JavaScript code. This can result in a denial-of-service (DoS) condition or, under certain conditions, escape the sandboxed environment intended to restrict code execution. The vulnerability stems from insufficient prototype access checks in the sandbox’s executor logic, particularly in the handling of JavaScript function objects returned.
- Product
- sandboxjs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.