SandboxJS, a JavaScript sandboxing library, contained a flaw that allowed sandboxed code to mutate host built‑in prototypes. By placing a global prototype reference into an array and retrieving it, the library stripped a protection flag, enabling direct prototype modification from within the sandbox. This persistent host‑side prototype pollution is a case of CWE‑1321 and can lead to remote code execution if polluted properties are used in sensitive sinks such as execSync. The CVSS score of 9.1 indicates a high severity, emphasizing the seriousness of this issue. EPSS scoring below 1% suggests a low current exploitation probability, and the vulnerability is not yet listed in CISA’s KEV catalog.

The affected product is nyariv SandboxJS running on Node.js. Versions prior to 0.8.31 are vulnerable. Upgrades to 0.8.31 or later contain the fix and are recommended for all installations that rely on sandbox protection.

The vulnerability can be exploited by an attacker who can execute code within the sandbox environment, such as a malicious module or user‑supplied script. Through array intermediaries, the attacker can reach and alter built‑in prototypes that persist beyond the sandbox boundaries, potentially exposing the host application to code execution attacks if those polluted properties influence privileged operations. Although the exploitation probability is low at present, the high CVSS score and the nature of prototype pollution warrant swift remedial action.