{"id":"EUVD-2026-32968","enisaUuid":"222fde4f-41b9-314d-b944-abc1ad7955ca","description":"SandboxJS is a JavaScript sandboxing library. Prior to 0.9.6, sandbox-defined functions expose Function.caller, allowing sandboxed code to recover the internal LispType.Call runtime callback. That callback can then be invoked with attacker-controlled fake context and obj values to extract blocked host statics, recover the real host Function constructor, and execute arbitrary host JavaScript. This vulnerability is fixed in 0.9.6.","datePublished":"May 28, 2026, 5:50:31 PM","dateUpdated":"May 28, 2026, 7:32:45 PM","baseScore":10.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","references":"https://github.com/nyariv/SandboxJS/security/advisories/GHSA-g8f2-4f4f-5jqw\nhttps://github.com/nyariv/SandboxJS/commit/826865251232611ec94078bab5a18ec875dad4a5\n","aliases":"CVE-2026-43898\nGHSA-g8f2-4f4f-5jqw\n","assigner":"GitHub_M","epss":0.47,"enisaIdProduct":[{"id":"d5bac97b-7537-33d8-b0d3-5480a7024744","product":{"name":"sandboxjs","vendor":{"name":"nyariv"}},"product_version":"\u003c 0.9.6"}],"enisaIdVendor":[{"id":"01d9e375-574e-3f62-81d3-ab4540a8c6be","vendor":{"name":"nyariv"}}],"enisaIdVulnerability":[{"id":"17513397-1aab-3525-98db-ae9bd9bb39ec","vulnerability":{"id":"GHSA-g8f2-4f4f-5jqw","description":"SandboxJS has a sandbox escape via Function.caller leakage of internal call op","datePublished":"May 11, 2026, 7:40:00 PM","dateUpdated":"Jun 9, 2026, 2:00:59 AM","baseScore":0.0,"references":"https://github.com/nyariv/SandboxJS/security/advisories/GHSA-g8f2-4f4f-5jqw\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43898\nhttps://github.com/nyariv/SandboxJS/commit/826865251232611ec94078bab5a18ec875dad4a5\nhttps://github.com/nyariv/SandboxJS\n","enisa_id":"EUVD-2026-32968\n","aliases":"CVE-2026-43898\nGHSA-g8f2-4f4f-5jqw\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:00:21 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"3a34e9b9-f2a5-31cf-9c67-ef4ed075b411","vulnerability":{"id":"CVE-2026-43898","description":"SandboxJS is a JavaScript sandboxing library. Prior to 0.9.6, sandbox-defined functions expose Function.caller, allowing sandboxed code to recover the internal LispType.Call runtime callback. That callback can then be invoked with attacker-controlled fake context and obj values to extract blocked host statics, recover the real host Function constructor, and execute arbitrary host JavaScript. This vulnerability is fixed in 0.9.6.","datePublished":"May 28, 2026, 5:50:31 PM","dateUpdated":"May 28, 2026, 7:32:45 PM","status":"PUBLISHED","baseScore":10.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","references":"https://github.com/nyariv/SandboxJS/security/advisories/GHSA-g8f2-4f4f-5jqw\nhttps://github.com/nyariv/SandboxJS/commit/826865251232611ec94078bab5a18ec875dad4a5\n","enisa_id":"EUVD-2026-32968\n","assigner":"GitHub_M","epss":0.47,"dataProcessed":"Nov 7, 2026, 7:21:53 AM","vulnerabilityProduct":[{"id":"a71986ca-f8d6-3977-b06b-0efdab7519a1","product":{"name":"sandboxjs","vendor":{"name":"nyariv"}},"product_version":"\u003c 0.9.6"}],"vulnerabilityVendor":[{"id":"d265c847-ba31-3809-8ea0-73c088c6fe7b","vendor":{"name":"nyariv"}}]}}],"enisaIdAdvisory":[]}