What is the CVSS score of CVE-2026-25520?

CVE-2026-25520 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Sandboxjs are affected by CVE-2026-25520?

SandboxJS versions before 0.8.29 contain a critical vulnerability (CVSS 10.0) that allows attackers to bypass sandbox protections and execute arbitrary code within applications using this library.. A patch is available.

Is there a public PoC exploit available for CVE-2026-25520?

Yes, a public proof-of-concept exploit is available for CVE-2026-25520. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-25520?

Within 24 hours: Inventory all systems and applications using SandboxJS and identify which versions are deployed; immediately disable SandboxJS functionality if operationally feasible pending patching. Within 7 days: Apply vendor patch to upgrade SandboxJS to version 0.8.29 or later across all affected systems; conduct full application testing post-patch to ensure functionality. Within 30 days: Complete post-incident assessment, review logs for evidence of exploitation, and implement enhanced monitoring for suspicious JavaScript execution patterns.

Sandboxjs CVE-2026-25520

CRITICAL

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-02-06 security-advisories@github.com

GHSA-58jh-xv4v-pcx4

RCE Sandboxjs

10.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 18, 2026 - 14:33 vuln.today

Public exploit code

Patch released

Feb 18, 2026 - 14:33 nvd

Patch available

CVE Published

Feb 06, 2026 - 20:16 nvd

CRITICAL 10.0

DescriptionGitHub Advisory

SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, The return values of functions aren't wrapped. Object.values/Object.entries can be used to get an Array containing the host's Function constructor, by using Array.prototype.at you can obtain the hosts Function constructor, which can be used to execute arbitrary code outside of the sandbox. This vulnerability is fixed in 0.8.29.

AnalysisAI

SandboxJS has a second CVSS 10.0 sandbox escape where function return values aren't properly sanitized, allowing code execution outside the sandbox.

Technical ContextAI

SandboxJS < 0.8.29 has a CWE-74 injection vulnerability where function return values bypass sandbox restrictions, allowing sandboxed code to inject and execute code in the host context.