{"action":"Upgrade @nyariv/sandboxjs to 0.9.6 or later.","affected":[{"fixed":"0.9.6","introduced":"0"}],"component":"@nyariv/sandboxjs","cve_ids":["CVE-2026-43898"],"ecosystem":"npm","epss":0.00472,"exploited":false,"fixed_versions":["0.9.6"],"ghsa_id":"GHSA-g8f2-4f4f-5jqw","id":"tcs_01M5KFQZMHGCPMN11M5M95DX0N","modified_at":"2026-09-10T03:51:05.528606073Z","published_at":"2026-05-11T19:40:00Z","references":["https://osv.dev/vulnerability/GHSA-g8f2-4f4f-5jqw","https://github.com/nyariv/SandboxJS/security/advisories/GHSA-g8f2-4f4f-5jqw","https://nvd.nist.gov/vuln/detail/CVE-2026-43898","https://github.com/nyariv/SandboxJS/commit/826865251232611ec94078bab5a18ec875dad4a5","https://github.com/nyariv/SandboxJS"],"severity":{"label":"critical","score":10},"sources":[{"source":"osv","source_id":"GHSA-g8f2-4f4f-5jqw","url":"https://osv.dev/vulnerability/GHSA-g8f2-4f4f-5jqw"}],"summary":"SandboxJS has a sandbox escape via Function.caller leakage of internal call op"}