CVE-2026-25587

SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, as Map is in SAFEPROTOYPES, it's prototype can be obtained via Map.prototype. By overwriting Map.prototype.has the sandbox can be escaped. This vulnerability is fixed in 0.8.29...

CVE-2026-25587 SandboxJS has a Sandbox Escape

SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, as Map is in SAFEPROTOYPES, it's prototype can be obtained via Map.prototype. By overwriting Map.prototype.has the sandbox can be escaped. This vulnerability is fixed in 0.8.29...

@afidos/nestjs-event-notifications (>=2.2.1, <=2.2.2), @mieweb/wikigdrive (>=2.15.0, <=2.17.1) +3 more potentially affected by CVE-2026-25587 via @nyariv/sandboxjs (>=0.5.3, <=0.8.25)

@nyariv/sandboxjs NPM version =0.5.3, =2.2.1, =2.15.0, =0.2.0, =11.0.0, =12.0.1 Source cves: CVE-2026-25587 Source advisory: OSV:GHSA-66H4-QJ4X-38XP...

@afidos/nestjs-event-notifications (>=2.2.1, <=2.2.2), @mieweb/wikigdrive (>=2.15.0, <=2.17.1) +3 more potentially affected by CVE-2026-25142 +1 more via @nyariv/sandboxjs (>=0.5.3, <=0.8.25)

@nyariv/sandboxjs NPM version =0.5.3, =2.2.1, =2.15.0, =0.2.0, =11.0.0, =12.0.1 Source cves: CVE-2026-25142, CVE-2026-25587 Source advisory: SNYK:JS-NYARIVSANDBOXJS-15248292...