This vulnerability is a TOCTOU race condition in the property access validation of SandboxJS. When the library checks if a key exists using hasOwnProperty, it uses one value, but when actually accessing the property it uses another value derived from the supplied input. Because keys that are strings are not strictly enforced, an attacker can supply an object that coerces to two distinct string values, causing the sandbox check to pass while the subsequent property read occurs outside of the intended sandbox. The result is a sandbox escape that may allow an attacker to execute arbitrary code in the host environment, effectively providing full control over the process. The flaw is a classic example of the time‑of‑check to time‑of‑use race condition (CWE‑367).

The affected product is SandboxJS by nyariv. Any deployment that uses a version older than 0.8.29 is vulnerable. The library runs within Node.js applications, so the risk applies to any JavaScript runtime that incorporates this dependency. No specific operating system is mentioned; the impact is confined to the JavaScript execution environment.

The CVSS base score is 10, indicating a potentially complete compromise of the host process if exploited. The EPSS score is currently below 1 %, suggesting that successful exploitation is unlikely at present. The vulnerability is not listed in CISA's KEV catalog, indicating no documented widespread exploitation. Attackers would need to provide crafted JavaScript objects that coerce to different string values to trigger the TOCTOU. Once the sandbox boundary is bypassed, the attacker can run arbitrary Node.js code.