Vulnerability Description
SandboxJS is a JavaScript sandboxing library. Prior to 0.9.6, sandbox-defined functions expose Function.caller, allowing sandboxed code to recover the internal LispType.Call runtime callback. That callback can then be invoked with attacker-controlled fake context and obj values to extract blocked host statics, recover the real host Function constructor, and execute arbitrary host JavaScript. This vulnerability is fixed in 0.9.6.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nyariv | Sandboxjs | < 0.9.6 |
Related Weaknesses (CWE)
References
- https://github.com/nyariv/SandboxJS/commit/826865251232611ec94078bab5a18ec875dadPatch
- https://github.com/nyariv/SandboxJS/security/advisories/GHSA-g8f2-4f4f-5jqwExploitVendor Advisory
- https://github.com/nyariv/SandboxJS/security/advisories/GHSA-g8f2-4f4f-5jqwExploitVendor Advisory
FAQ
What is CVE-2026-43898?
CVE-2026-43898 is a vulnerability with a CVSS score of 10.0 (CRITICAL). SandboxJS is a JavaScript sandboxing library. Prior to 0.9.6, sandbox-defined functions expose Function.caller, allowing sandboxed code to recover the internal LispType.Call runtime callback. That cal...
How severe is CVE-2026-43898?
CVE-2026-43898 has been rated CRITICAL with a CVSS base score of 10.0/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-43898?
Check the references section above for vendor advisories and patch information. Affected products include: Nyariv Sandboxjs.