Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.35, SandboxJS timers have an execution-quota bypass. A global tick state (`currentTicks.current`) is shared between sandboxes. Timer string handlers are compiled at execution time using that global tick state rather than the scheduling sandbox's tick object. In multi-tenant / concurrent sandbox scenarios, another sandbox can overwrite `currentTicks.current` between scheduling and execution, causing the timer callback to run under a different sandbox's tick budget and bypass the original sandbox's execution quota/watchdog. Version 0.8.35 fixes this issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-32723 SandboxJS is a JavaScript sandboxing library. Prior to 0.8.35, SandboxJS timers have an execution-quota bypass. A global tick state (`currentTicks.current`) is shared… https://www.cve.org/CVERecord?id=CVE-2026-32723
Post summary
The text discloses a new execution‑quota bypass vulnerability in SandboxJS timers, providing technical details but no exploit evidence or patch information.
CVE-2026-32723 SandboxJS Timer Execution-Quota Bypass in Versions Prior to 0.8.35 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-32723
Post summary
The text announces CVE-2026-32723, a SandboxJS Timer Execution-Quota Bypass affecting versions before 0.8.35, but provides no further exploit details or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | nyariv | sandboxjs | - | node.js | - |