The vulnerability in versions of the sandboxing library prior to 0.8.26 stems from the fact that the global constructor for asynchronous functions is not replaced during the sandboxing process. This oversight allows code that runs inside the sandbox to retrieve the native AsyncFunction constructor through the .constructor property of an async function instance. Constructing a new async function with this native constructor executes code in the host environment rather than within the isolated sandbox, enabling attackers to run arbitrary code with all privileges of the host process. The flaw is characterized by the weaknesses listed in CWE‑693, CWE‑913, and CWE‑94.

Users of the JavaScript sandboxing library from the developer known as nyariv, specifically any installations of SandboxJS with a version older than 0.8.26, are affected. The vulnerability exists in the library’s implementation of sandboxed function construction and persists until the update is applied.

Given the CVSS score of 10, the potential impact of this flaw is maximum; an attacker can completely escape the sandbox and execute arbitrary code. The EPSS score of less than 1 percent indicates that, while the likelihood of exploitation is currently low, the severity dictates that it should be treated with urgency. The vulnerability has not yet been listed in the CISA Known Exploited Vulnerabilities catalog, but the lack of a catalog entry does not diminish the need for timely remediation. Without a patch, the flaw can be exploited by any code path that creates or accesses asynchronous functions within the sandbox.