CVE-2026-26954: SandboxJS affected by a Sandbox Escape

March 13, 2026 (updated March 16, 2026)

It is possible to obtain arrays containing Function, which allows escaping the sandbox.

References

github.com/advisories/GHSA-6r9f-759j-hjgv
github.com/nyariv/SandboxJS
github.com/nyariv/SandboxJS/commit/e01505b1ea49f4f13956cd12b7ce01b83d2ee085
github.com/nyariv/SandboxJS/releases/tag/v0.8.34
github.com/nyariv/SandboxJS/security/advisories/GHSA-6r9f-759j-hjgv
nvd.nist.gov/vuln/detail/CVE-2026-26954

Code Behaviors & Features

Detect and mitigate CVE-2026-26954 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →