SandboxJS versions before 0.8.36 contain a protection mechanism failure (CWE-693) that allows attackers to bypass restrictions on modifying global objects. The vulnerability arises because the constructor property resolves to an internal SandboxGlobal function, and Function.prototype.call is permitted, enabling attacker-controlled code to write arbitrary properties into host global objects. These changes persist across sandbox instances in the same process, compromising sandbox isolation. This issue is addressed in version 0.8.36 of SandboxJS.

Successful exploitation allows an attacker to modify global objects arbitrarily, leading to persistent mutations that affect all sandbox instances within the same process. This compromises the sandbox's isolation guarantees, potentially enabling full compromise of the host environment's confidentiality and integrity. Availability impact is low. The CVSS score of 10.0 reflects the critical nature of this vulnerability.

Upgrade SandboxJS to version 0.8.36 or later, where this vulnerability is fixed. Since the vulnerability is resolved in this version, no additional mitigation steps are required beyond applying the update. Patch status is not explicitly stated in the vendor advisory, but the description confirms the fix is included in version 0.8.36.