关键漏洞信息 漏洞摘要 CVE ID: CVE-2026-25586 漏洞类型: Sandbox Escape via Prototype Whitelist Bypass and Host Prototype Pollution 严重性: Critical (CVSS: 3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) 受影响和修复的版本 受影响版本: 0.8.28 修复版本: 0.8.29 漏洞描述 exploiting on a sandbox object, which allows direct access to and other blockaded prototype properties, permitting host pollution. This could result in persistent cross-sandbox effects. 根源分析 The method is utilized directly in , which can be bypassed if the sandboxed object shadows . When it returns true, the whitelist checks are bypassed. 概念验证 Baseline: Blocked access to host successfully. Prototype whitelist bypass: Successfully polluted the host , resulting in being true. DoS: Overriding caused an error. RCE: Using a host gadget through . 代码示例