Количество 3
Количество 3
CVE-2026-43898
SandboxJS is a JavaScript sandboxing library. Prior to 0.9.6, sandbox-defined functions expose Function.caller, allowing sandboxed code to recover the internal LispType.Call runtime callback. That callback can then be invoked with attacker-controlled fake context and obj values to extract blocked host statics, recover the real host Function constructor, and execute arbitrary host JavaScript. This vulnerability is fixed in 0.9.6.
GHSA-g8f2-4f4f-5jqw
SandboxJS has a sandbox escape via Function.caller leakage of internal call op
BDU:2026-09273
Уязвимость функции createFunction() файла executorUtils.ts библиотеки SandboxJS, позволяющая нарушителю выполнить произвольный код
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2026-43898 SandboxJS is a JavaScript sandboxing library. Prior to 0.9.6, sandbox-defined functions expose Function.caller, allowing sandboxed code to recover the internal LispType.Call runtime callback. That callback can then be invoked with attacker-controlled fake context and obj values to extract blocked host statics, recover the real host Function constructor, and execute arbitrary host JavaScript. This vulnerability is fixed in 0.9.6. | CVSS3: 10 | 0% Низкий | 2 месяца назад |
| GHSA-g8f2-4f4f-5jqw SandboxJS has a sandbox escape via Function.caller leakage of internal call op | CVSS3: 10 | 0% Низкий | 3 месяца назад |
 | BDU:2026-09273 Уязвимость функции createFunction() файла executorUtils.ts библиотеки SandboxJS, позволяющая нарушителю выполнить произвольный код | CVSS3: 10 | 0% Низкий | 3 месяца назад |
Уязвимостей на страницу