CVE-2025-34146: CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in nyariv sandboxjs
A prototype pollution vulnerability exists in @nyariv/sandboxjs versions <= 0.8.23, allowing attackers to inject arbitrary properties into Object.prototype via crafted JavaScript code. This can result in a denial-of-service (DoS) condition or, under certain conditions, escape the sandboxed environment intended to restrict code execution. The vulnerability stems from insufficient prototype access checks in the sandbox’s executor logic, particularly in the handling of JavaScript function objects returned.
AI Analysis
Technical Summary
This vulnerability in @nyariv/sandboxjs (<=0.8.23) arises from improper control of modification of object prototype attributes (CWE-1321). Attackers can exploit this by injecting properties into Object.prototype through specially crafted JavaScript code executed within the sandbox. The root cause is inadequate checks on prototype access in the sandbox's executor, especially when handling JavaScript function objects returned from the sandbox. Exploitation can cause denial-of-service or allow code to escape the sandbox restrictions.
Potential Impact
Successful exploitation can result in denial-of-service conditions or, under specific circumstances, allow an attacker to escape the sandbox environment designed to restrict code execution. This undermines the security guarantees of the sandbox, potentially leading to unauthorized code execution outside the intended restrictions.
Mitigation Recommendations
No official patch or fix is currently available for this vulnerability. Users should monitor the vendor advisory for updates. Until a fix is released, avoid using vulnerable versions or restrict usage scenarios to trusted code only.
CVE-2025-34146: CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in nyariv sandboxjs
Description
A prototype pollution vulnerability exists in @nyariv/sandboxjs versions <= 0.8.23, allowing attackers to inject arbitrary properties into Object.prototype via crafted JavaScript code. This can result in a denial-of-service (DoS) condition or, under certain conditions, escape the sandboxed environment intended to restrict code execution. The vulnerability stems from insufficient prototype access checks in the sandbox’s executor logic, particularly in the handling of JavaScript function objects returned.
CVSS v4.0
Score 7.0high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in @nyariv/sandboxjs (<=0.8.23) arises from improper control of modification of object prototype attributes (CWE-1321). Attackers can exploit this by injecting properties into Object.prototype through specially crafted JavaScript code executed within the sandbox. The root cause is inadequate checks on prototype access in the sandbox's executor, especially when handling JavaScript function objects returned from the sandbox. Exploitation can cause denial-of-service or allow code to escape the sandbox restrictions.
Potential Impact
Successful exploitation can result in denial-of-service conditions or, under specific circumstances, allow an attacker to escape the sandbox environment designed to restrict code execution. This undermines the security guarantees of the sandbox, potentially leading to unauthorized code execution outside the intended restrictions.
Mitigation Recommendations
No official patch or fix is currently available for this vulnerability. Users should monitor the vendor advisory for updates. Until a fix is released, avoid using vulnerable versions or restrict usage scenarios to trusted code only.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2025-04-15T19:15:22.564Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 688b891aad5a09ad00b91987
Added to database: 07/31/2025, 15:17:46 UTC
Last enriched: 06/24/2026, 15:02:15 UTC
Last updated: 09/10/2026, 19:36:50 UTC
Views: 249
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.