CVE-2026-34208

Published Apr 6, 2026

Last updated 3 months ago

CVSS critical 10.0
OT

Overview

Description
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, SandboxJS blocks direct assignment to global objects (for example Math.random = ...), but this protection can be bypassed through an exposed callable constructor path: this.constructor.call(target, attackerObject). Because this.constructor resolves to the internal SandboxGlobal function and Function.prototype.call is allowed, attacker code can write arbitrary properties into host global objects and persist those mutations across sandbox instances in the same process. This vulnerability is fixed in 0.8.36.
Source
security-advisories@github.com
NVD status
Analyzed
Products
sandboxjs

Risk scores

CVSS 3.1

Type
Primary
Base score
10
Impact score
6
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity
CRITICAL

Weaknesses

security-advisories@github.com
CWE-693

Social media

Hype score
Not currently trending

  1. :اليومي CVE ملخص ال 🔴 CVE-2025-54328 [Samsung Mobile Processor] 🔴 CVE-2026-34208 [SandboxJS library prior to 0.8.36] 🔴 CVE-2026-5734 [Firefox < 149.0.2] 🔴 CVE-2026-0740 [WordPress sites using Ninja Forms - File Uploads plugin version 3.3.26 or lower

    @Alharbi_Abz

    8 Apr 2026

    157 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. 🔍 Today's Top Vulnerabilities 🔴 CVE-2026-34208 | CVSS 10.0 🔴 CVE-2026-34976 | CVSS 10.0 🔴 CVE-2025-54328 | CVSS 10.0 🔗 https://t.co/MGnNrzO0Nd #CVE #Vulnerability #ThreatIntel

    @ctiwatchcloud

    7 Apr 2026

    113 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Configurations

Related CVEs

  1. A denial-of-service security issue exists in 1734 POINT I/O™ module. The security issue stems from improper handling of crafted CIP messages, which can cause the module to enter a faulted state. A restart is required to recover.•CVE-2026-10573
  2. A vulnerability has been identified in Opcenter X (All versions < V2604). Affected applications do not properly validate the algorithm specified in the JSON Web Token (JWT) header. This could allow an unauthenticated remote attacker to forge arbitrary JWT, bypass authentication mechanisms and impersonate any user including administrative accounts, potentially gaining full unauthorized access to the application.•CVE-2026-56451
  3. Gardyn devices expose a privileged iothubowner key. Access to this key will allow a malicious user to invoke an IoTHub Registry Manager function which returns connection information for all Gardyn Home Kit and Studio devices. Access to this key also allows a malicious user to execute arbitrary commands on a specific connected device and may allow the malicious user to pivot to other devices on the user's network.•CVE-2026-13768
  4. Storage Concentrator (SC & SCVM) contains a command injection vulnerability within the debug.pl script that is reachable without authentication. A remote attacker can submit a specially crafted HTTP request containing a malicious payload that is processed without adequate input sanitization, resulting in arbitrary command execution with root-level privileges on the underlying system.•CVE-2026-56415
  5. Storage Concentrator (SC & SCVM) contains a command injection vulnerability in the ms_service.pl service, which listens on TCP port 9000 by default and accepts custom network packets to perform device actions. An unauthenticated remote attacker can send a specially crafted packet containing a malicious payload that is processed without adequate sanitization, resulting in arbitrary command execution with root-level privileges.•CVE-2026-56413

References

Sources include official advisories and independent security research.