Skip to content
Threat Feed

Product

@Nyariv/Sandboxjs (<= 0.9.5)

1 brief RSS
critical advisory

SandboxJS Function.caller Sandbox Escape Vulnerability (CVE-2026-43898)

SandboxJS is vulnerable to a sandbox escape (CVE-2026-43898); by exploiting the `Function.caller` property, sandboxed code can access the internal `LispType.Call` runtime callback, which allows an attacker to manipulate the context and arguments of the callback, leading to the execution of arbitrary host JavaScript and a complete sandbox escape.

@nyariv/sandboxjs sandbox-escape rce javascript
2r 2t