CVE-2026-25586

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2026-25586 is a critical sandbox escape vulnerability in SandboxJS, an open-source JavaScript sandboxing library. Versions prior to 0.8.29 are affected, where an attacker can shadow the hasOwnProperty method on a sandbox object. This action disables prototype whitelist enforcement during property access, allowing direct access to blocked prototype properties such as __proto__. Consequently, this enables host Object.prototype pollution and persistent impact across multiple sandboxes. The vulnerability carries a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and is associated with CWE-74.

Remote attackers can exploit this vulnerability over the network with low complexity, requiring no privileges, authentication, or user interaction. By executing malicious JavaScript code within a sandboxed environment, they can bypass isolation controls, pollute the host Object.prototype, and achieve persistent effects that propagate across sandboxes. This grants high-impact confidentiality, integrity, and availability compromises with a changed scope, potentially leading to full code execution on the host environment.

The vulnerability was fixed in SandboxJS version 0.8.29, as detailed in the project's GitHub security advisory (GHSA-jjpw-65fv-8g48) and the corresponding commit (67cb186c41c78c51464f70405504e8ef0a6e43c3). Security practitioners should update to 0.8.29 or later and review deployments using SandboxJS for exposure, particularly in web applications or Node.js environments relying on sandboxing for untrusted code execution.