CVE-2026-43898
SandboxJS is a JavaScript sandboxing library.
Published May 28, 2026 · updated Oct 14, 2026 · nyariv sandboxjs
SandboxJS is a JavaScript sandboxing library. Prior to 0.9.6, sandbox-defined functions expose Function.caller, allowing sandboxed code to recover the internal LispType.Call runtime callback. That callback can then be invoked with attacker-controlled fake context and obj values to extract blocked host statics, recover the real host Function constructor, and execute arbitrary host JavaScript. This vulnerability is fixed in 0.9.6.
Timeline
Detection, updates, and resolution for this record.
May 28, 2026 · NIST NVD
Detected
SandboxJS is a JavaScript sandboxing library. Prior to 0.9.6, sandbox-defined functions expose Function.caller, allowing sandboxed code to recover the internal LispType.Call runtime callback. That callback can then be invoked with attacker-controlled fake context and obj values to extract blocked host statics, recover the real host Function constructor, and execute arbitrary host JavaScript. This
Oct 14, 2026 · NIST NVD
Updated
SandboxJS is a JavaScript sandboxing library. Prior to 0.9.6, sandbox-defined functions expose Function.caller, allowing sandboxed code to recover the internal LispType.Call runtime callback. That callback can then be invoked with attacker-controlled fake context and obj values to extract blocked host statics, recover the real host Function constructor, and execute arbitrary host JavaScript. This
Affected
- cpe nyariv/sandboxjsversion unspecified
Sources
- CVE.orgCVE-2026-43898
Official CVE identifier
cve.org - FIRST EPSSCVE-2026-43898
30-day exploitation probability 0.6%
first.org - NIST NVDCVE-2026-43898
SandboxJS is a JavaScript sandboxing library. Prior to 0.9.6, sandbox-defined functions expose Function.caller, allowing sandboxed code to recover the internal LispType.Call runtime callback. That callback can then be invoked with attacker-controlled fake context and obj values t
nvd.nist.gov