Skip to content
OpenAdvisories

Package · npm

sandbox

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Critical —
    GHSA-gc25-3vc5-2jf9

    Sandbox Breakout / Arbitrary Code Execution in sandbox

    All versions of `sandbox` are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context through `this.constructor.constructor` . This may allow attackers to execute arbitrary code in the system. Ev…

    sandbox npm
  • Medium —
    GHSA-fm4j-4xhm-xpwx

    Sandbox Breakout / Arbitrary Code Execution in sandbox

    All versions of `sandbox` through 0.8.2 are vulnerable to Sandbox Escape leading to Remote Code Execution. Due to insufficient input sanitization it is possible to escape the sandbox using constructors. ## Proof of concept ``` var Sandbox = require("sandbox")…

    sandbox npm