critical10.0
CVE-2026-43898
SandboxJS has a sandbox escape via Function.caller leakage of internal call op
Impact
SandboxJS is a JavaScript sandboxing library. Prior to 0.9.6, sandbox-defined functions expose Function.caller, allowing sandboxed code to recover the internal LispType.Call runtime callback. That callback can then be invoked with attacker-controlled fake context and obj values to extract blocked host statics, recover the real host Function constructor, and execute arbitrary host JavaScript. This vulnerability is fixed in 0.9.6.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @nyariv/sandboxjs | <= 0.9.5 | 0.9.6 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nyariv | Sandboxjs | before 0.9.6 |