What is the CVSS score of CVE-2026-26954?

CVE-2026-26954 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Sandboxjs are affected by CVE-2026-26954?

CVE-2026-26954 is a critical sandbox escape vulnerability in SandboxJS that allows attackers to execute arbitrary code with full system access, posing an immediate threat to any application using…. A patch is available.

How to fix or mitigate CVE-2026-26954?

Within 24 hours: Inventory all applications and dependencies using SandboxJS to identify exposure scope; isolate or disable affected services if operationally feasible. Within 7 days: Implement network segmentation to restrict lateral movement from compromised systems; deploy WAF rules to detect exploitation attempts; establish enhanced monitoring for suspicious JavaScript execution patterns. Within 30 days: Evaluate alternative sandboxing solutions; develop a migration plan away from SandboxJS; conduct security assessments of potentially affected systems; coordinate with vendor for patch availability timeline.

Sandboxjs CVE-2026-26954

EUVD-2026-12043 CRITICAL

Code Injection (CWE-94)

2026-03-13 GitHub_M

GHSA-6r9f-759j-hjgv

RCE Code Injection Sandboxjs

10.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 13, 2026 - 16:57 euvd

EUVD-2026-12043

Analysis Generated

Mar 13, 2026 - 16:57 vuln.today

CVE Published

Mar 13, 2026 - 15:51 nvd

CRITICAL 10.0

DescriptionGitHub Advisory

SandboxJS is a JavaScript sandboxing library. Prior to 0.8.34, it is possible to obtain arrays containing Function, which allows escaping the sandbox. Given an array containing Function, and Object.fromEntries, it is possible to construct {[p]: Function} where p is any constructible property. This vulnerability is fixed in 0.8.34.