SandboxJS is a JavaScript sandboxing library that, before version 0.8.27, fails to restrict the use of the __lookupGetter__ property. This flaw allows a malicious user to manipulate object prototypes, leading to a prototype‑pollution attack that can bypass the sandbox environment and execute arbitrary JavaScript code. The vulnerability is identified as prototype pollution (CWE‑1321) and code injection (CWE‑94), culminating in remote code execution.

The affected product is nyariv's SandboxJS. All releases older than 0.8.27 are vulnerable. Users of earlier versions that import the library into Node.js applications are susceptible unless the library is patched or updated.

The CVSS score is 10, indicating a critical threat. EPSS is below 1 % suggesting a low probability of widespread exploitation, and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. Based on the description, it is inferred that the attack vector likely involves supplying crafted JavaScript code that utilizes the __lookupGetter__ feature to mutate prototypes, thereby escaping the sandbox boundaries and running arbitrary code on the host environment.