SandboxJS, a JavaScript sandboxing library, has a flaw where the return values of functions are not wrapped. By using Object.values or Object.entries on a sandboxed object, an attacker can retrieve an array that includes the host’s Function constructor. Leveraging Array.prototype.at allows the attacker to extract the host Function constructor, which can then be used to execute arbitrary code outside the sandboxed context. This allows remote code execution from within the sandbox, granting full control of the host process.

The affected product is SandboxJS by nyariv. All versions prior to 0.8.29 are vulnerable. The vulnerability is fixed in 0.8.29 and later releases. No other vendors or products are listed.

The vulnerability has a CVSS score of 10, indicating a critical impact. The EPSS score is less than 1%, suggesting low likelihood of exploitation at this time. It is not included in the CISA KEV catalog. Exploitation would likely come from any JavaScript code that is allowed to run inside the sandbox; thus, systems exposing user-controlled scripts to SandboxJS are at risk.