Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
nyariv/SandboxJS
main @ 8268652
31
Fixes
13
CVEs
CRITICAL
Peak severity
3.7%
Coverage
Highlights
Sandbox Escape: 13 prior fixes. Scrutinize any change in this area.
src/executor.ts: most-fixed (12 issues). Treat as high-risk during review.
23 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Sandbox Escape: Attackers can bypass the sandbox by accessing host-context constructors (like Function or AsyncFunction) or by traversing prototypes to manipulate global objects. This has occurred through property resolution pathways and unvalidated context wrappers.
Sandbox Bypass: Prototype pollution and property-traversal bypasses allow attackers to overwrite core properties or leverage native features like '__proto__', '__defineGetter__', or '__lookupGetter__' to reach the host context.
Denial of Service: Unbounded recursion, massive array allocations, and infinite loop constructs within sandboxed scripts can lead to stack exhaustion or CPU/memory starvation if tick quotas and parser depth recursion limits are not strictly enforced on all paths.