CVE-2026-25142

CriticalCVSS 10.0/10Last modified Jun 17, 2026

Description

SandboxJS is a JavaScript sandboxing library. Prior to 0.8.27, SanboxJS does not properly restrict __lookupGetter__ which can be used to obtain prototypes, which can be used for escaping the sandbox / remote code execution. This vulnerability is fixed in 0.8.27.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-94 CWE-1321

Affected software

Vendor	Product	Versions
nyariv	SandboxJS	< 0.8.27

References

Timeline

Published: Feb 2, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-251437.8melange allows users to build apk packages using declarative pipelines. From version 0.10.0 to before 0.40.3, an attacker who can influence CVE-2026-251445.3Talishar is a fan-made Flesh and Blood project. A Stored XSS exists in the chat in-game system. The playerID parameter in SubmitChat.php and CVE-2026-251455.5melange allows users to build apk packages using declarative pipelines. From version 0.14.0 to before 0.40.3, an attacker who can influence CVE-2026-251468.1OpenEMR is a free and open source electronic health records and medical practice management application. From 5.0.2 to before 8.0.0, there a CVE-2026-251477.1OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, in `portal/CVE-2026-251486.1Qwik is a performance focused javascript framework. Prior to version 1.19.0, a Cross-Site Scripting vulnerability in Qwik.js' server-side re CVE-2026-251496.1Qwik is a performance focused javascript framework. Prior to version 1.19.0, an Open Redirect vulnerability in Qwik City's default request h CVE-2026-25155.3The Hostinger Reach – AI-Powered Email Marketing for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due t CVE-2026-2515010.0Qwik is a performance focused javascript framework. Prior to version 1.19.0, a prototype pollution vulnerability exists in the formToObj() f CVE-2026-251515.9Qwik is a performance focused javascript framework. Prior to version 1.19.0, Qwik City’s server-side request handler inconsistently interpre CVE-2026-251526.5Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities f CVE-2026-251538.8Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities f