CVE-2025-34146
nyariv sandboxjs 0.8.23 Prototype Pollution Sandbox Escape DoS
- State
- Published
- Severity
- 7.0 High
- Published
- Jul 31, 2025
- Updated
- Oct 8, 2026
- Reserved
- Apr 15, 2025
Description
A prototype pollution vulnerability exists in @nyariv/sandboxjs versions <= 0.8.23, allowing attackers to inject arbitrary properties into Object.prototype via crafted JavaScript code. This can result in a denial-of-service (DoS) condition or, under certain conditions, escape the sandboxed environment intended to restrict code execution. The vulnerability stems from insufficient prototype access checks in the sandbox’s executor logic, particularly in the handling of JavaScript function objects returned.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.0 High | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
Weaknesses
- CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Affected Products
| Product | Versions |
|---|---|
sandboxjsnyariv |
|
References
- https://gist.github.com/Hagrid29/9df27829a491080f923c4f6b8518d7e3issue-trackingexploit
- https://github.com/nyariv/SandboxJS/issues/31issue-tracking
- https://www.npmjs.com/package/@nyariv/sandboxjsproduct
- https://www.vulncheck.com/advisories/nyariv-sandboxjs-prototype-pollution-sandbox-escape-dosthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.