CVE-2026-32723
Description
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.35, SandboxJS timers have an execution-quota bypass. A global tick state (currentTicks.current) is shared between sandboxes. Timer string handlers are compiled at execution time using that global tick state rather than the scheduling sandbox's tick object. In multi-tenant / concurrent sandbox scenarios, another sandbox can overwrite currentTicks.current between scheduling and execution, causing the timer callback to run under a different sandbox's tick budget and bypass the original sandbox's execution quota/watchdog. Version 0.8.35 fixes this issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
@nyariv/sandboxjsnpm | < 0.8.35 | 0.8.35 |
Affected products
3Patches
Vulnerability mechanics
References
4- github.com/nyariv/SandboxJS/commit/cc8f20b4928afed5478d5ad3d1737ef2dcfaac29nvdPatchWEB
- github.com/nyariv/SandboxJS/security/advisories/GHSA-7p5m-xrh7-769rnvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-7p5m-xrh7-769rghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-32723ghsaADVISORY
News mentions
0No linked articles in our index yet.