CVE-2026-25587 — AI Deep Analysis Summary

🚨 **Essence**: SandboxJS < 0.8.29 has a critical flaw allowing **Sandbox Escape**. 📉 **Consequences**: Attackers can break out of the isolated environment, leading to full system compromise.…

🛡️ **CWE-94**: Improper Control of Generation of Code ('Code Injection'). 💥 **Flaw**: The vulnerability stems from **overwriting `Map.prototype.has`**.…

🏢 **Vendor**: nyariv. 📦 **Product**: SandboxJS (Security Assessment Tool). 📅 **Affected**: Versions **prior to 0.8.29**. If you are running an older build, you are exposed.

👑 **Privileges**: High. The CVSS score indicates **Complete** impact on Confidentiality, Integrity, and Availability. 🗝️ **Data**: Attackers gain unrestricted access, effectively bypassing the security sandbox entirely.

🔓 **Threshold**: Low. CVSS Vector `AV:N/AC:L/PR:N/UI:N` means: **Network** accessible, **Low** complexity, **No** privileges required, **No** user interaction needed. It’s a remote, automated exploit.

🔍 **Public Exp?**: No PoCs listed in the data yet. 🌐 **References**: Official advisory and commit fix are public.…

🔎 **Self-Check**: Scan your environment for **SandboxJS** installations. 📊 **Version Control**: Verify if the installed version is **< 0.8.29**. If yes, you are vulnerable.…

✅ **Fixed**: Yes. 🛠️ **Patch**: Version **0.8.29** and above are safe. 🔗 **Commit**: Fix is available at `67cb186c41c78c51464f70405504e8ef0a6e43c3`. Update immediately to the latest release.

🚧 **No Patch?**: If you cannot update, **isolate** the SandboxJS instance. 🚫 **Network**: Restrict network access to prevent remote exploitation.…

🔥 **Urgency**: **CRITICAL**. With `S:C` (Changed Scope) and high CVSS, this is a top-priority fix. 🏃 **Action**: Patch now. Do not wait for an exploit to appear. The risk of total compromise is immediate.