Prototype Pollution in nyariv sandboxjs version 0.8.23 Product nyariv sandboxjs Version 0.8.23 Description SandboxJS version 0.8.23 contains a prototype pollution vulnerability that can cause Denial of Service (DoS) and potentially escape the sandbox by injecting arbitrary properties. PoC Analysis Prototype Access Checking SandboxJS performs prototype access checking in . The check with of returns false, causing no to be caught. Similarly, no is caught during the checking of prototype access of . The payload works well with in place of . Sandboxed function/object SandboxJS uses Regex to detect any function declared in the code . The payload is not caught by any regex expression. Scope is not defined during the execution of in sandboxed functions, allowing execution without errors. Reference https://www.npmjs.com/package/@nyariv/sandboxjs nyariv/SandboxJS#31