PT-2025-31547 · Unknown · @Nyariv/Sandboxjs
CVSS v4.0
7.0
High
| Vector | AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
@nyariv/sandboxjs versions through 0.8.23
Description
A prototype pollution issue exists in @nyariv/sandboxjs, allowing attackers to inject arbitrary properties into
Object.prototype via crafted JavaScript code. This can lead to a denial-of-service (DoS) condition or, potentially, escape the sandboxed environment. The root cause is insufficient prototype access checks within the sandbox’s executor logic, specifically when handling JavaScript function objects returned.Recommendations
Update @nyariv/sandboxjs to a version later than 0.8.23.
Exploit
Fix
DoS
Prototype Pollution
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
@Nyariv/Sandboxjs