SandboxJS is a JavaScript sandboxing library that, before version 0.8.34, allows an attacker to obtain arrays containing Function objects. By combining such an array with Object.fromEntries, an adversary can construct an object with arbitrary constructible property keys pointing to Function values. This flaw enables a sandbox escape, giving the attacker the ability to execute arbitrary code within the host Node.js process. The weakness aligns with CWE‑94 (Code Injection).

The vulnerability affects the nyariv sandboxjs library for all versions prior to 0.8.34. Any deployment that includes a version of SandboxJS older than 0.8.34 is potentially exploitable.

The CVSS score is 10, indicating critical severity. The EPSS score is less than 1%, suggesting a low probability of real‑world exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector is inferred to be local exploitation through providing malicious input or code to the sandboxed environment, and is likely to be exploitable in server‑side Node.js applications that use SandboxJS. If the attacker can supply input that is evaluated by SandboxJS, they may escape the sandbox and run arbitrary code.