CVE-2026-34217 Details
Description
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, a scope modification vulnerability exists in @nyariv/sandboxjs. The vulnerability allows untrusted sandboxed code to leak internal interpreter objects through the new operator, exposing sandbox scope objects in the scope hierarchy to untrusted code; an unexpected and undesired exploit. While this could allow modifying scopes inside the sandbox, code evaluation remains sandboxed and prototypes remain protected throughout the execution. This vulnerability is fixed in 0.8.36.
A scope modification vulnerability has been identified in the @nyariv/sandboxjs library, affecting versions through 0.8.35. This vulnerability allows untrusted, sandboxed code to leak internal interpreter objects by using the new operator. The leaked objects include sandbox scope objects from the scope hierarchy, which could be accessed by the untrusted code. Although this vulnerability could enable modifications to the sandboxed scopes, the code execution remains confined to the sandbox, and prototypes are protected during execution.
Users are advised to update to @nyariv/sandboxjs version 0.8.36 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nyariv/SandboxJS/security/advisories/GHSA-hg73-4w7g-q96w | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/nyariv/SandboxJS/security/advisories/GHSA-hg73-4w7g-q96w | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-668 | Exposure of Resource to Wrong Sphere | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nyariv sandboxjs | < 0.8.36 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 9, 2026 | Initial Analysis | [email protected] |
| Apr 6, 2026 | New CVE Received | [email protected] |
| Apr 6, 2026 | CVE Modified | CISA-ADP |