CVE-2026-43898 Details
Description
SandboxJS is a JavaScript sandboxing library. Prior to 0.9.6, sandbox-defined functions expose Function.caller, allowing sandboxed code to recover the internal LispType.Call runtime callback. That callback can then be invoked with attacker-controlled fake context and obj values to extract blocked host statics, recover the real host Function constructor, and execute arbitrary host JavaScript. This vulnerability is fixed in 0.9.6.
A vulnerability in SandboxJS versions prior to 0.9.6 allows sandboxed functions to access Function.caller. This exposure lets the sandboxed code retrieve a sensitive internal callback, which can be manipulated to extract restricted host information, access the real host Function constructor, and execute arbitrary JavaScript in the host environment. The issue arises from the property access logic that fails to properly restrict access to certain function properties, enabling the leakage of a privileged callback that can be exploited to bypass the sandbox's security measures.
Users should update to SandboxJS version 0.9.6 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nyariv/SandboxJS/security/advisories/GHSA-g8f2-4f4f-5jqw | CISA-ADP | ExploitVendor Advisory |
| https://github.com/nyariv/SandboxJS/commit/826865251232611ec94078bab5a18ec875dad4a5 | [email protected] | Patch |
| https://github.com/nyariv/SandboxJS/security/advisories/GHSA-g8f2-4f4f-5jqw | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nyariv sandboxjs | < 0.9.6 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | Initial Analysis | [email protected] |
| May 28, 2026 | New CVE Received | [email protected] |