https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 18:45:19 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-32723 <p>SandboxJS is a JavaScript sandboxing library. Prior to 0.8.35, SandboxJS timers have an execution-quota bypass. A global tick state (`currentTicks.current`) is shared between sandboxes. Timer string handlers are compiled at execution time using that global tick state rather than the scheduling sandbox&#39;s tick object. In multi-tenant / concurrent sandbox scenarios, another sandbox can overwrite `currentTicks.current` between scheduling and execution, causing the timer callback to run under a different sandbox&#39;s tick budget and bypass the original sandbox&#39;s execution quota/watchdog. Version 0.8.35 fixes this issue.</p> <p>SandboxJS is a JavaScript sandboxing library. Prior to 0.8.35, SandboxJS timers have an execution-quota bypass. A global tick state (`currentTicks.current`) is shared between sandboxes. Timer string handlers are compiled at execution time using that global tick state rather than the scheduling sandbox&#39;s tick object. In multi-tenant / concurrent sandbox scenarios, another sandbox can overwrite `currentTicks.current` between scheduling and execution, causing the timer callback to run under a different sandbox&#39;s tick budget and bypass the original sandbox&#39;s execution quota/watchdog. Version 0.8.35 fixes this issue.</p> https://db.gcve.eu/vuln/fkie_cve-2026-32723 https://db.gcve.eu/vuln/ghsa-7p5m-xrh7-769r <p><strong>Affected:</strong> npm: @nyariv/sandboxjs</p> <p>## Summary</p> <p>Assumed repo path is `/Users/zwique/Downloads/SandboxJS-0.8.34` (no `/Users/zwique/Downloads/SandboxJS` found). A global tick state (`currentTicks.current`) is shared between sandboxes. Timer string handlers are compiled at execution time using that global tick state rather than the scheduling sandbox&#39;s tick object. In multi-tenant / concurrent sandbox scenarios, another sandbox can overwrite `currentTicks.current` between scheduling and execution, causing the timer callback to run under a different sandbox&#39;s tick budget and bypass the original sandbox&#39;s execution quota/watchdog.</p> <p>**Impact:** execution quota bypass → CPU/resource abuse</p> <p>---</p> <p>## Details</p> <p>- **Affected project:** SandboxJS (owner: nyariv) - **Assumed checked-out version:** `SandboxJS-0.8.34` at `/Users/zwique/Downloads/SandboxJS-0.8.34`</p> <p>### Vulnerable code paths</p> <p>- **`/src/eval.ts`** — `sandboxFunction` binds `ticks` using `ticks || currentTicks.current`: ``` createFunction(..., ticks || currentTicks.current, { ...context, ... }) ``` Relevant lines: 44, 53, 164, 167.</p> <p>- **`/src/evaluator.ts` / `/src/executor.ts`** — global ticks: ``` export const currentTicks = { current: { ticks: BigInt(0) } as Ticks }; ``` and ``` _execNoneRecurse(...) { currentTicks.current = ticks; ... } ``` Relevant lines: ~1700, 1712.</p> <p>- **`sandboxedSetTimeout`** compiles string handlers at execution time, not at scheduling time, which lets `currentTicks.current` be the wrong sandbox&#39;s ticks when com…</p> <p><strong>Affected:</strong> npm: @nyariv/sandboxjs</p> <p>## Summary</p> <p>Assumed repo path is `/Users/zwique/Downloads/SandboxJS-0.8.34` (no `/Users/zwique/Downloads/SandboxJS` found). A global tick state (`currentTicks.current`) is shared between sandboxes. Timer string handlers are compiled at execution time using that global tick state rather than the scheduling sandbox&#39;s tick object. In multi-tenant / concurrent sandbox scenarios, another sandbox can overwrite `currentTicks.current` between scheduling and execution, causing the timer callback to run under a different sandbox&#39;s tick budget and bypass the original sandbox&#39;s execution quota/watchdog.</p> <p>**Impact:** execution quota bypass → CPU/resource abuse</p> <p>---</p> <p>## Details</p> <p>- **Affected project:** SandboxJS (owner: nyariv) - **Assumed checked-out version:** `SandboxJS-0.8.34` at `/Users/zwique/Downloads/SandboxJS-0.8.34`</p> <p>### Vulnerable code paths</p> <p>- **`/src/eval.ts`** — `sandboxFunction` binds `ticks` using `ticks || currentTicks.current`: ``` createFunction(..., ticks || currentTicks.current, { ...context, ... }) ``` Relevant lines: 44, 53, 164, 167.</p> <p>- **`/src/evaluator.ts` / `/src/executor.ts`** — global ticks: ``` export const currentTicks = { current: { ticks: BigInt(0) } as Ticks }; ``` and ``` _execNoneRecurse(...) { currentTicks.current = ticks; ... } ``` Relevant lines: ~1700, 1712.</p> <p>- **`sandboxedSetTimeout`** compiles string handlers at execution time, not at scheduling time, which lets `currentTicks.current` be the wrong sandbox&#39;s ticks when com…</p> https://db.gcve.eu/vuln/ghsa-7p5m-xrh7-769r