CVE-2026-26954
Published: 13 March 2026
Summary
CVE-2026-26954 is a critical-severity Code Injection (CWE-94) vulnerability in Nyariv Sandboxjs. Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique JavaScript (T1059.007); ranked at the 41.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
SandboxJS, a JavaScript sandboxing library, contains a critical vulnerability identified as CVE-2026-26954 in versions prior to 0.8.34. The flaw allows attackers to obtain arrays containing the Function constructor, enabling sandbox escape. Specifically, with access to such an array and the Object.fromEntries method, adversaries can construct objects like {[p]: Function} where p represents any constructible property, bypassing sandbox restrictions. This issue is classified under CWE-94 (Improper Control of Generation of Code) and carries a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
The vulnerability can be exploited remotely by unauthenticated attackers over the network with low complexity and no user interaction required. Successful exploitation leads to full sandbox escape, granting high-impact confidentiality, integrity, and availability compromises in a changed scope, potentially allowing arbitrary code execution within the targeted JavaScript environment.
The GitHub Security Advisory (GHSA-6r9f-759j-hjgv) confirms that the vulnerability is fixed in SandboxJS version 0.8.34, recommending immediate upgrades to mitigate the risk. No additional workarounds are specified in the provided references.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-12043
Vulnerability details
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.34, it is possible to obtain arrays containing Function, which allows escaping the sandbox. Given an array containing Function, and Object.fromEntries, it is possible to construct {[p]: Function} where p is any…
more
constructible property. This vulnerability is fixed in 0.8.34.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Sandbox escape in JS library directly enables arbitrary JavaScript execution (T1059.007) via Function constructor abuse and remote unauthenticated exploitation of the hosting application (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly and comprehensively addresses CVE-2026-26954 by requiring timely remediation through upgrade to the fixed SandboxJS version 0.8.34.
Identifies the presence of the vulnerable SandboxJS library prior to 0.8.34 through vulnerability scanning, enabling proactive patching.
Mandates software-enforced separation policies critical for JavaScript sandbox integrity, mitigating escape via Function constructor access.