---
id: CVE-2025-34146
title: >-
  A prototype pollution vulnerability exists in @nyariv/sandboxjs versions <=
  0.8.23, allowing attackers to inject arbitrary properties into
  Object.prototype via crafted JavaScript code
summary: >-
  A prototype pollution vulnerability exists in @nyariv/sandboxjs versions <=
  0.8.23, allowing attackers to inject arbitrary properties into
  Object.prototype via crafted JavaScript code. This can result in a
  denial-of-service (DoS) conditi…
severity: high
cvss: 7
cvssVector: 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N'
cwe:
  - CWE-1321
vendor: nyariv
product: sandboxjs
affected:
  - sandboxjs <= 0.8.23
published: '2025-07-31'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T16:16:51.177'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-34146'
references:
  - url: 'https://gist.github.com/Hagrid29/9df27829a491080f923c4f6b8518d7e3'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/nyariv/SandboxJS/issues/31'
    label: disclosure@vulncheck.com
  - url: 'https://www.npmjs.com/package/@nyariv/sandboxjs'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/nyariv-sandboxjs-prototype-pollution-sandbox-escape-dos
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2025-07-31T20:06:42.380992Z'
cvssSource: cna
epss: 0.00211
epssPercentile: 0.10491
ingestedAt: '2026-10-08T16:52:14.664Z'
---

## Overview

A prototype pollution vulnerability exists in @nyariv/sandboxjs versions <= 0.8.23, allowing attackers to inject arbitrary properties into Object.prototype via crafted JavaScript code. This can result in a denial-of-service (DoS) condition or, under certain conditions, escape the sandboxed environment intended to restrict code execution. The vulnerability stems from insufficient prototype access checks in the sandbox’s executor logic, particularly in the handling of JavaScript function objects returned.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.