Sandbox escape via Function.caller leakage in SandboxJS (CVE-2026-43898)

Sandbox-defined functions in SandboxJS expose `Function.caller`, enabling sandboxed code to recover the internal `LispType.Call` runtime callback. An attacker can invoke this callback with attacker-controlled `context` and `obj` values to extract blocked host statics, recover the real host `Function` constructor, and execute arbitrary host JavaScript. Successful exploitation results in a full sandbox escape leading to remote code execution. Affected versions: - <= 0.9.5 We recommend updating to: 0.9.6. CVSS 10.0 · our assessment: act_now Reference: https://github.com/nyariv/SandboxJS/security/advisories/GHSA-g8f2-4f4f-5jqw Details: https://vuln.today/cve/CVE-2026-43898