CVE-2026-25520

CVE-2026-25520 affects SandboxJS (JavaScript sandboxing library) prior to version 0.8.29. The underlying issue is that function return values aren’t wrapped, allowing attackers to use Object.values/Object.entries and Array.prototype.at to retrieve the host’s Function constructor. With access to t...