CVE-2026-43898
CriticalSummary
SandboxJS is a JavaScript sandboxing library. Prior to version 0.9.6, sandbox-defined functions expose Function.caller, allowing recovery of the internal LispType.Call runtime callback.
Risk Assessment
An attacker can exploit this vulnerability to execute arbitrary host JavaScript code, posing a significant security risk to the application.
Recommendation
It is recommended to upgrade to version 0.9.6 or later to mitigate this vulnerability.
Original NVD description (English source)
SandboxJS is a JavaScript sandboxing library. Prior to 0.9.6, sandbox-defined functions expose Function.caller, allowing sandboxed code to recover the internal LispType.Call runtime callback. That callback can then be invoked with attacker-controlled fake context and obj values to extract blocked host statics, recover the real host Function constructor, and execute arbitrary host JavaScript. This vulnerability is fixed in 0.9.6.