Prototype Pollution

SandboxJS is vulnerable to Prototype Pollution. The vulnerability is due to improper handling of the isGlobal protection flag, where wrapping a host global prototype in an array strips its taint and allows sandboxed code to mutate host built-in prototypes, leading to prototype pollution and...

Prototype Pollution

Overview @nyariv/sandboxjs is a Javascript sandboxing library. Affected versions of this package are vulnerable to Prototype Pollution via the sandbox implements a protection mechanism using the isGlobal flag in the Prop class. An attacker can modify host built-in prototypes by laundering the...