CVE-2026-25641

Name of the Vulnerable Software and Affected Versions SandboxJS versions prior to 0.8.29

Description SandboxJS, a JavaScript sandboxing library, has a sandbox escape issue. This is due to a mismatch between the key used for validation and the key used for property access. The key, intended to be a string, is not enforced as such, allowing attackers to use malicious objects that change string values during sanitization and property access. This could lead to remote code execution if an attacker can execute code within the sandbox.

Recommendations Versions prior to 0.8.29 should be updated to version 0.8.29.