External risk intelligence

SandboxJS Function Caller Vulnerability Allows Host JavaScript Execution.

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-43898

SandboxJS is a software library designed to be integrated into applications to sandbox code execution. It is a development-time dependency or a component within a larger system, not a standalone internet-facing service, appliance, or edge gateway. It lacks inherent network exposure in typical deployment patterns.

Code Injection

Nyariv Sandboxjs

before 0.9.6

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the SandboxJS JavaScript sandboxing library that could allow untrusted code to execute arbitrary commands within the host environment. This issue arises from a weakness in how sandboxed functions expose internal runtime details, potentially enabling attackers to bypass security controls and gain unauthorized access. Confirming if this library is in use is the primary concern.

JavaScript sandbox library flaw allows code escape.
High severity, could impact all systems using it.
Verify usage and update SandboxJS if affected.

Attack Path

How an attacker could exploit the issue

An attacker could gain control by exploiting a flaw in how SandboxJS handles functions defined within its sandbox. By tricking the sandboxed code into revealing an internal callback, an attacker could then use this callback to execute arbitrary JavaScript code on the host system, bypassing security restrictions. This could lead to a complete compromise of the host environment.

No authentication or user interaction needed.
Sandboxed code triggers the vulnerability.
Arbitrary host JavaScript execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, sandboxed code could gain access to internal runtime callbacks, potentially allowing the extraction of blocked host information and the execution of arbitrary host JavaScript.

Internal runtime callbacks could be exposed.
Sandboxed code may invoke callbacks with malicious values.
Arbitrary host JavaScript execution could occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects the SandboxJS library, a JavaScript sandboxing tool. The primary responsibility for addressing this issue likely falls to the application or platform teams integrating SandboxJS, as they manage dependencies and runtime environments. The first practical step is to identify all applications utilizing this library, confirm their reachability and business criticality, and then coordinate remediation efforts with the accountable owners to minimize risk.

Application owners should manage this issue.
Verify current SandboxJS dependency versions.
Plan and execute updates during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SandboxJS?

SandboxJS is a library used by developers to isolate and execute untrusted JavaScript code safely. It creates a restricted environment within a larger Node.js application, aiming to prevent guest code from accessing the underlying host system's memory or functions.

How does CVE-2026-43898 allow code escape?

This vulnerability is an instance of CWE-94: Improper Control of Generation of Code. Because SandboxJS fails to properly hide internal runtime details, sandboxed code can access restricted callbacks. By manipulating these callbacks, guest code can bypass the sandbox, recover the host's primary constructor, and run arbitrary JavaScript with the host's full permissions.

What must happen to trigger this vulnerability?

An attacker needs the ability to supply or influence the JavaScript code running inside the SandboxJS instance. The vulnerability does not trigger if the sandbox is empty or only runs trusted, hard-coded logic. It specifically requires the sandboxed environment to execute malicious, attacker-controlled scripts that attempt to access restricted object properties.

Do I need to worry about this if my app is internal?

According to Halo Surface Signal, SandboxJS is a development-time component integrated into larger systems rather than a standalone, internet-facing service. While internal, the risk remains if your application allows users or external entities to submit or trigger code that executes within a SandboxJS-protected context.

How do I fix the vulnerability in SandboxJS?

The fix involves updating the SandboxJS library to version 0.9.6 or later. First, audit your software dependencies to locate where SandboxJS is integrated. Once identified, work with your development or application teams to update the dependency version, as this update removes the exposure of internal runtime callbacks that enabled the bypass.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.