SandboxJS npm Package Sandbox Escape Vulnerability
An early warning has been issued regarding a sandbox escape vulnerability in the SandboxJS npm package. This vulnerability, reportedly due to the exposure of `Function.caller` in sandbox-defined functions, allows sandboxed code to recover internal runtime callbacks and execute arbitrary host JavaScript.
What happened
The SandboxJS npm package is under investigation for a sandbox escape vulnerability tracked as GHSA-G8F2-4F4F-5JQW. This vulnerability appears to allow sandboxed code to recover internal runtime callbacks and execute arbitrary host JavaScript, due to the exposure of `Function.caller` in sandbox-defined functions.
To assess your exposure, check if your project dependencies include @nyariv/sandboxjs. If so, it is recommended to upgrade to the latest version that patches this vulnerability. Additionally, review any custom sandboxed code for potential exploitation.
For more detailed information, consult the primary source at [GHSA-g8f2-4f4f-5jqw](https://github.com/advisories/GHSA-g8f2-4f4f-5jqw). The severity of this issue is currently classified as HIGH, and further details are expected as the investigation progresses.
How 0Day mitigates this
@nyariv/sandboxjs is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.