SandboxJS is a JavaScript sandboxing library. In versions before 0.8.29, an attacker can shadow the hasOwnProperty method on a sandbox instance, disabling the library’s prototype whitelist. This allows direct access to __proto__ and other blocked prototype properties, leading to host Object.prototype pollution that persists across sandbox boundaries and undermines isolation.

nyariv’s SandboxJS library, all releases prior to 0.8.29, is affected. The library is used in Node.js environments to evaluate untrusted JavaScript code.

The CVSS score is 10, but the EPSS score is less than 1 %, indicating a very low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires execution within a SandboxJS instance, typically when untrusted code is evaluated. By overriding hasOwnProperty, an attacker can access __proto__ and pollute Object.prototype, affecting all sandboxed code sharing the same host context.