CVE-2026-34208

Katalog CVE

CVSS 10.0 · Critical EPSS 0,60%

Kerentanan Protection Mechanism Failure pada nyariv sandboxjs. Skor CVSS 3.1 10.0 (Critical) menurut NVD.

Deskripsi (NVD)

SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, SandboxJS blocks direct assignment to global objects (for example Math.random = ...), but this protection can be bypassed through an exposed callable constructor path: this.constructor.call(target, attackerObject). Because this.constructor resolves to the internal SandboxGlobal function and Function.prototype.call is allowed, attacker code can write arbitrary properties into host global objects and persist those mutations across sandbox instances in the same process. This vulnerability is fixed in 0.8.36.

Rincian

Terbit di NVD

6 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

10.0 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-693: Protection Mechanism Failure
CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes

EPSS (30 hari)

0,60% peluang dieksploitasi; lebih tinggi dari 47,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nyariv/SandboxJS/security/advisories/GHSA-2gg9-6p7w-6cpj exploit · advisory vendor