
SandboxJS fixes Critical sandbox escape to host code execution (CVE-2026-26954)
SandboxJS disclosed a Critical sandbox escape where untrusted JavaScript can obtain the host Function constructor and achieve host-level code execution; fixed in 0.8.34.
NewsVulnerabilityJavaScript
13 Mar 2026