Listen to this Post
How the CVE Works
The vulnerability in `@nyariv/sandboxjs` (<= v0.8.23) arises due to improper validation of user-supplied input when processing JavaScript objects in the sandboxed environment. Attackers can craft malicious payloads that modify Object.prototype, leading to prototype pollution. By injecting properties into the prototype chain, an attacker can bypass sandbox restrictions, potentially causing DoS or remote code execution (RCE) if the polluted properties are later used in unsafe operations like `eval()` or dynamic function creation.
DailyCVE Form
Platform: @nyariv/sandboxjs
Version: <= 0.8.23
Vulnerability: Prototype Pollution
Severity: High
Date: Jul 31, 2025
Prediction: Patch by Aug 15, 2025
What Undercode Say
npm audit --production grep -r "Object.prototype" /path/to/sandboxjs
// PoC triggering pollution
const sandbox = require('@nyariv/sandboxjs');
sandbox.run('Object.prototype.polluted = "yes"');
How Exploit
- Crafted JS payload modifies
Object.prototype. - Polluted properties bypass sandbox.
- Leads to RCE/DoS.
Protection from this CVE
- Upgrade to patched version.
- Disable dynamic code execution.
- Use strict input sanitization.
Impact
- Sandbox escape.
- Remote code execution.
- System compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
