CVE-2026-43898: SandboxJS: Sandbox escape via Function.caller leakage of internal call op

Synopsis

This is a sandbox escape vulnerability in SandboxJS, a JavaScript sandboxing library. The flaw is reachable over the network with no authentication required, and the CVSS scope is changed, meaning a successful attacker breaks out of the sandboxed execution context entirely. Exploitation gives the attacker arbitrary JavaScript execution on the host, with full read, write, and availability impact on the surrounding system. No fix version has been published yet; HarborGuard tracks the advisory and will make a patched-image rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the service over the network; the AV:N vector means no local or physical access is needed.

• AuthenticationNot required

  No credentials or account are needed; PR:N means an unauthenticated attacker can trigger the vulnerability.

• Victim interactionNot required

  No user action is required; the attacker exploits the flaw without any victim needing to click, open, or approve anything.

• Attack complexityDetail

  Attack complexity is Low (AC:L), meaning the exploit is reliable and requires no special race conditions, memory layout knowledge, or environmental setup.

Blast Radius

• The attacker escapes the JavaScript sandbox entirely and executes arbitrary code in the host JavaScript runtime.
• The attacker reads host-side data, including blocked statics, environment variables, secrets, and any in-process state accessible to the host runtime.
• The attacker modifies host runtime state, altering application logic, persisted data, or in-memory structures outside the sandbox boundary.
• The attacker can crash or destabilize the host process, causing full service disruption.