Skip to content

RadicalNotion.AI

We do not sell or share your personal information

© 2026 RadicalNotion.AI

Security Data

CWE Directory
CAPEC Directory
CNA Directory
CNA Report Cards
Data Sources

Calculators

CVSS Calculator
CVSS 4.0
CVSS 3.1
CVSS 3.0
CVSS 2.0

Platform

My Vulnerabilities
Insights
Notifications
Account
Pricing

Learn

All guides
What is a CVE?
What is CVSS?
The CISA KEV catalog
What is EPSS?

Company

About us
Blog
Book a demo

Get Started

Sign up
Log in

Legal

Privacy
Terms

Security data

Weaknesses (CWE)The MITRE CWE weakness catalog
Attack Patterns (CAPEC)MITRE CAPEC attack patterns
CNAsNumbering authorities + report cards
VendorsVulnerabilities by vendor

Tools

CVSS CalculatorScore CVSS 4.0, 3.1, 3.0 & 2.0

Resources

LearnPlain-English security guides
Data SourcesHow we source CVE data

About Us Blog Pricing Book a Demo

Log in

Home
Vendors
Nyariv
Sandboxjs

nyariv sandboxjs Vulnerabilities: CVEs, CISA KEV & Security Advisories

14 CVEs

nyariv sandboxjs Vulnerabilities

CVE security advisories and vulnerability history for sandboxjs by nyariv.

14

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

12

Public exploits

With known exploit

8.9

Avg CVSS

2025–2026

Last updated May 28, 2026

Overview

nyariv sandboxjs has 14 published CVE records since 2025, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 12 have a known public exploit. The average CVSS base score across scored CVEs is 8.9.

This page aggregates every publicly disclosed vulnerability (CVE) affecting nyariv sandboxjs, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Severity and exploitation

How the CVSS severity of nyariv sandboxjs's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical10

High2

Medium2

Low0

In CISA’s Known Exploited Vulnerabilities catalog

0

None of nyariv sandboxjs's CVEs are currently listed in CISA's KEV catalog.

Public exploits

12

12 of nyariv sandboxjs's CVEs have a known public exploit available.

Affected versions and CVEs

Browse every nyariv sandboxjs version named in a CVE, then pick one to see only the CVEs that affect it.

Specific versions

Fixed in

0.8.294 CVEs
67cb186c41c78c51464f70405504e8ef0a6e43c34 CVEs
0.8.363 CVEs
> 0.8.231 CVE
0.8.261 CVE
0.8.271 CVE
0.8.311 CVE
0.8.341 CVE
0.8.351 CVE
0.9.61 CVE
354229c64992478dc43ca9345543b5fed83ccf661 CVE
584f8ae960b4fcfc18feb833c8c6b49157874ccd1 CVE
75c8009db32e6829b0ad92ca13bf458178442bd31 CVE

Find a version

14 CVEs

Sort

SandboxJS: Sandbox escape via Function.caller leakage of internal call op
CVE-2026-43898
Public exploit
Patch
CWE-94
Critical · CVSS 10.0
EPSS 0.1% (19th pct)2026-05-28
SandboxJS has a Sandbox Escape via Prop Object Leak in New Handler
CVE-2026-34217
Public exploit
Patch
CWE-668
Medium · CVSS 6.9
EPSS 0.1% (27th pct)2026-04-06
SandboxJS: Stack overflow DoS via deeply nested expressions in recursive descent parser
CVE-2026-34211
Public exploit
Patch
CWE-674
High · CVSS 7.5
EPSS 0.1% (24th pct)2026-04-06
SandboxJS: Sandbox integrity escape
CVE-2026-34208
Public exploit
Patch
CWE-693
Critical · CVSS 10.0
EPSS 0.3% (51th pct)2026-04-06
SandboxJS timers have an execution-quota bypass (cross-sandbox currentTicks race)
CVE-2026-32723
Public exploit
Patch
CWE-362
Medium · CVSS 4.8
EPSS 0.0% (0th pct)2026-03-18
SandboxJS has a Sandbox Escape
CVE-2026-26954
Public exploit
Patch
CWE-94
Critical · CVSS 10.0
EPSS 0.1% (26th pct)2026-03-13
@nyariv/sandboxjs has host prototype pollution from sandbox via array intermediary (sandbox escape)
CVE-2026-25881
Patch
CWE-1321
Critical · CVSS 9.1
EPSS 0.1% (18th pct)2026-02-09
SandboxJS has a Sandbox Escape via Prototype Whitelist Bypass and Host Prototype Pollution
CVE-2026-25586
Public exploit
Patch
CWE-74
Critical · CVSS 10.0
EPSS 0.0% (10th pct)2026-02-06
SandboxJS has a Sandbox Escape
CVE-2026-25520
Public exploit
Patch
CWE-74
Critical · CVSS 10.0
EPSS 0.1% (17th pct)2026-02-06
SandboxJS has a Sandbox Escape
CVE-2026-25587
Public exploit
Patch
CWE-94
Critical · CVSS 10.0
EPSS 0.0% (10th pct)2026-02-06
SandboxJS has a sandbox escape via TOCTOU bug on keys in property accesses
CVE-2026-25641
Public exploit
Patch
CWE-367
Critical · CVSS 10.0
EPSS 0.0% (7th pct)2026-02-06
SandboxJS Prototype Pollution -> Sandbox Escape -> RCE
CVE-2026-25142
Patch
CWE-94
Critical · CVSS 10.0
EPSS 0.3% (49th pct)2026-02-02
SandboxJS has Sandbox Escape via Unprotected AsyncFunction Constructor
CVE-2026-23830
Public exploit
Patch
CWE-94
Critical · CVSS 10.0
EPSS 0.2% (46th pct)2026-01-27
nyariv sandboxjs 0.8.23 Prototype Pollution Sandbox Escape DoS
CVE-2025-34146
Public exploit
Patch
CWE-1321
High · CVSS 7.0
EPSS 1.5% (81th pct)2025-07-31

Common weakness types

The CWE weakness categories most often found in nyariv sandboxjs CVEs. Follow any weakness for its full explanation.

CWE-94Improper Control of Generation of Code ('Code Injection')5 CVEs
CWE-1321Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')2 CVEs
CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')2 CVEs
CWE-668Exposure of Resource to Wrong Sphere1 CVE
CWE-674Uncontrolled Recursion1 CVE
CWE-693Protection Mechanism Failure1 CVE
CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')1 CVE
CWE-367Time-of-check Time-of-use (TOCTOU) Race Condition1 CVE

Disclosure activity by year

How many nyariv sandboxjs CVEs were published each year.

2025

1

2026

13

Other nyariv products

Browse vulnerabilities for other products by nyariv.

@nyariv/sandboxjs13 CVEs

All nyariv vulnerabilities

Frequently asked questions

Common questions about nyariv sandboxjs vulnerabilities.

How many CVEs does nyariv sandboxjs have?

nyariv sandboxjs has 14 published CVE records since 2025.

How many nyariv sandboxjs CVEs are in CISA KEV?

None of nyariv sandboxjs's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Are there public exploits for nyariv sandboxjs vulnerabilities?

Yes — 12 of nyariv sandboxjs's CVEs have a known public exploit.

Which versions of nyariv sandboxjs are affected?

65 distinct nyariv sandboxjs versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in nyariv sandboxjs CVEs?

nyariv sandboxjs's CVEs most often map to these CWE weakness types: CWE-94 (Improper Control of Generation of Code ('Code Injection')), CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')), CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')), CWE-668 (Exposure of Resource to Wrong Sphere).

How many critical nyariv sandboxjs vulnerabilities are there?

nyariv sandboxjs has 10 critical and 2 high-severity CVEs.

What is the average severity of nyariv sandboxjs CVEs?

The average CVSS base score across nyariv sandboxjs's scored CVEs is 8.9.

References

All nyariv vulnerabilities
The MITRE CVE Program (opens in a new tab)
Learn: What is a CVE?
CWE directory: the weakness types these CVEs map to

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track nyariv sandboxjs vulnerabilities

Monitor new nyariv sandboxjs vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing

On this page

Overview
Severity and exploitation
Affected versions and CVEs
Common weakness types
Disclosure activity
Other products
FAQ
References

cc8f20b4928afed5478d5ad3d1737ef2dcfaac291 CVE

f369f8db26649f212a6a9a2e7a1624cb2f705b531 CVE