Skip to content
OpenAdvisories

Vendor

nyariv

14 known vulnerabilities.

Products

SandboxJS 14
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.9
    CVE-2026-34217

    SandboxJS has a Sandbox Escape via Prop Object Leak in New Handler

    SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, a scope modification vulnerability exists in @nyariv/sandboxjs. The vulnerability allows untrusted sandboxed code to leak internal interpreter objects through the new operator, exposing sandbox sc…

    nyariv SandboxJS @nyariv/sandboxjs npm
  • Medium 6.9
    CVE-2026-34211

    SandboxJS: Stack overflow DoS via deeply nested expressions in recursive descent parser

    SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, the @nyariv/sandboxjs parser contains unbounded recursion in the restOfExp function and the lispify/lispifyExpr call chain. An attacker can crash any Node.js process that parses untrusted input by…

    nyariv SandboxJS @nyariv/sandboxjs npm
  • Medium 4.8
    CVE-2026-32723

    SandboxJS timers have an execution-quota bypass (cross-sandbox currentTicks race)

    SandboxJS is a JavaScript sandboxing library. Prior to 0.8.35, SandboxJS timers have an execution-quota bypass. A global tick state (`currentTicks.current`) is shared between sandboxes. Timer string handlers are compiled at execution time using that global ti…

    nyariv SandboxJS @nyariv/sandboxjs npm