CVE-2026-23830-SandBreak

SandBreak CVE-2026-23830 익스플로잇 생성기 및 자동 Pwn 도구 SandBreak 는 SandboxJS 탈출 취약점CVE-2026-23830을 활용하도록 설계된 강력한 Go 기반 익스플로잇 생성기입니다. 이 도구는 이전 버전의 sandboxjs에서 보호되지 않는 AsyncFunction 생성자를 악용하여 공격자가 V8 샌드박스 환경을 벗어나 호스트 시스템에서 임의 코드를 실행할 수 있게 합니다. Blind OOB Exfiltration , Defacement , Error-Based RCE 를 포함한 여러...

CVE-2026-23830: Improper Control of Generation of Code

SandboxJS is a JavaScript sandboxing library. Versions prior to 0.8.26 have a sandbox escape vulnerability due to AsyncFunction not being isolated in SandboxFunction. The library attempts to sandbox code execution by replacing the global Function constructor with a safe, sandboxed version...

CVE-2026-23830

SandboxJS is a JavaScript sandboxing library. Versions prior to 0.8.26 have a sandbox escape vulnerability due to AsyncFunction not being isolated in SandboxFunction. The library attempts to sandbox code execution by replacing the global Function constructor with a safe, sandboxed version...

CVE-2026-23830

SandboxJS (pre-0.8.26) contains a sandbox escape where AsyncFunction (and related constructors) are not isolated in SandboxFunction. The safe-replacement map omits AsyncFunction, GeneratorFunction, and AsyncGeneratorFunction, so accessing an async function’s .constructor can yield the native host...

CVE-2026-23830 SandboxJS has Sandbox Escape via Unprotected AsyncFunction Constructor

SandboxJS is a JavaScript sandboxing library. Versions prior to 0.8.26 have a sandbox escape vulnerability due to AsyncFunction not being isolated in SandboxFunction. The library attempts to sandbox code execution by replacing the global Function constructor with a safe, sandboxed version...

Improper Control of Dynamically-Managed Code Resources

Overview @nyariv/sandboxjs is a Javascript sandboxing library. Affected versions of this package are vulnerable to Improper Control of Dynamically-Managed Code Resources via the AsyncFunction constructor not being properly isolated in the sandboxing function. An attacker can execute arbitrary cod...