Nyariv vulnerabilities
We track 12 vulnerabilities in Nyariv products. 12 are rated high or critical, and none are known to be exploited. The most recent was published on May 28, 2026.
Latest Nyariv vulnerabilities
- 10.0 Critical severity
SandboxJS: Improper Control of Generation of Code
SandboxJS is a JavaScript sandboxing library. Prior to 0.9.6, sandbox-defined functions expose Function.caller, allowing sandboxed code to recover the internal LispType.Call runtime callback. That callback can then be invoked with attacker-controlled fake cont
- 7.2 High severity
SandboxJS: Exposure of Resource to Wrong Sphere
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, a scope modification vulnerability exists in @nyariv/sandboxjs. The vulnerability allows untrusted sandboxed code to leak internal interpreter objects through the new operator, exposing sandbox sco
- 10.0 Critical severity
SandboxJS: Protection Mechanism Failure
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, SandboxJS blocks direct assignment to global objects (for example Math.random = ...), but this protection can be bypassed through an exposed callable constructor path: this.constructor.call(target,
- 10.0 Critical severity
SandboxJS: Improper Control of Generation of Code
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.34, it is possible to obtain arrays containing Function, which allows escaping the sandbox. Given an array containing Function, and Object.fromEntries, it is possible to construct {[p]: Function} where
- 10.0 Critical severity
SandboxJS: Improperly Controlled Modification of Object Prototype Attributes
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.31, a sandbox escape vulnerability allows sandboxed code to mutate host built-in prototypes by laundering the isGlobal protection flag through array literal intermediaries. When a global prototype refe
- 9.0 Critical severity
SandboxJS: Time-of-check Time-of-use (TOCTOU) Race Condition
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, there is a sandbox escape vulnerability due to a mismatch between the key on which the validation is performed and the key used for accessing properties. Even though the key used in property access
- 10.0 Critical severity
SandboxJS: Improper Control of Generation of Code
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, as Map is in SAFE_PROTOYPES, it's prototype can be obtained via Map.prototype. By overwriting Map.prototype.has the sandbox can be escaped. This vulnerability is fixed in 0.8.29.
- 10.0 Critical severity
SandboxJS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, a sandbox escape is possible by shadowing hasOwnProperty on a sandbox object, which disables prototype whitelist enforcement in the property-access path. This permits direct access to __proto__ and
- 10.0 Critical severity
SandboxJS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, The return values of functions aren't wrapped. Object.values/Object.entries can be used to get an Array containing the host's Function constructor, by using Array.prototype.at you can obtain the ho
- 10.0 Critical severity
SandboxJS: Improperly Controlled Modification of Object Prototype Attributes
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.27, SanboxJS does not properly restrict __lookupGetter__ which can be used to obtain prototypes, which can be used for escaping the sandbox / remote code execution. This vulnerability is fixed in 0.8.2
- 10.0 Critical severity
SandboxJS: Improper Control of Generation of Code
SandboxJS is a JavaScript sandboxing library. Versions prior to 0.8.26 have a sandbox escape vulnerability due to `AsyncFunction` not being isolated in `SandboxFunction`. The library attempts to sandbox code execution by replacing the global `Function` constru
- 7.0 High severity
sandboxjs: Improperly Controlled Modification of Object Prototype Attributes
A prototype pollution vulnerability exists in @nyariv/sandboxjs versions <= 0.8.23, allowing attackers to inject arbitrary properties into Object.prototype via crafted JavaScript code. This can result in a denial-of-service (DoS) condition or, under certain co