CVE-2026-34208 - Vulnerability Analysis

Overview

SandboxJS < 0.8.36 contains a prototype pollution caused by exposed callable constructor path allowing attacker code to write arbitrary properties into host global objects, letting attackers persist mutations across sandbox instances, exploit requires crafted code execution within sandbox.

Severity & Score

Impact

Attackers can persistently modify host global objects, potentially leading to privilege escalation or arbitrary code execution.

Mitigation

Update to version 0.8.36 or later.

References

• https://github.com/nyariv/SandboxJS/security/advisories/GHSA-2gg9-6p7w-6cpj

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner