Loading story…
CERT/CC and public reporting disclosed a critical vulnerability in Terrarium, the open-source Python sandbox developed by Cohere AI, that can allow arbitrary code execution and sandbox escape. Tracked as CVE-2026-5752 and VU#414811, the flaw arises from JavaScript prototype chain traversal in the Pyodide WebAssembly environment, enabling an attacker with local access to execute code with root privileges in the host Node.js process without user interaction or special privileges.
The vulnerability could let attackers access sensitive files, communicate with other services on the container network, and potentially escape the container entirely. Researcher Jeremy Brown is credited with discovering the issue, and reports indicate Terrarium is no longer actively maintained, making a vendor patch unlikely. Defenders are advised to disable user code submission where possible, restrict and segment network access, closely monitor container activity, use stronger container isolation and orchestration controls, deploy web application firewall protections where applicable, and keep supporting dependencies updated.
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
Public reporting described the Terrarium flaw as CVE-2026-5752 and said successful exploitation could yield root code execution on the host Node.js process, access to sensitive files, lateral reach to container-network services, and potential container escape. The report also noted Terrarium is no longer actively maintained, making a patch unlikely, and highlighted mitigation guidance instead.
CERT/CC published VU#414811 documenting a vulnerability in Terrarium that allows arbitrary code execution. The advisory identified the issue as affecting the sandbox's handling of untrusted code and served as the first public disclosure in the provided references.
Security researcher Jeremy Brown discovered a critical vulnerability in Cohere AI's open-source Terrarium Python sandbox. The flaw involves JavaScript prototype chain traversal in the Pyodide WebAssembly environment, enabling arbitrary code execution and possible container escape.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability in the npm package **`@nyariv/sandboxjs`** allows attackers to escape the JavaScript sandbox and execute arbitrary code on the host system. The issue, tracked as **`CVE-2026-43898`**, affects all versions through **`0.9.5`** and has been rated **CVSS 10.0**. Public reporting and GitHub advisory coverage describe the flaw as a sandbox escape that can be triggered without credentials or user interaction, creating a path to full host takeover when applications use the library to process untrusted JavaScript. The bug stems from improper exposure of internal callback functionality during function property access, including **`caller`**, **`callee`**, and **`arguments`**, enabling attackers to recover the host **`Function`** constructor and run arbitrary JavaScript or system commands. Separate advisory reporting also describes a sandbox escape caused by a **TOCTOU** bug in key handling during property access, underscoring broader weaknesses in the package's isolation model. Maintainers released **`0.9.6`** to block access to the dangerous properties, and organizations using SandboxJS are being urged to upgrade immediately or stop executing untrusted code with the library.
Jun 29, 2026
Multiple **critical vulnerabilities in *SandboxJS***—a JavaScript sandboxing library used to run untrusted code—were disclosed as enabling **sandbox escape and arbitrary code execution on the host**, with several issues scored **CVSS 10.0**. Reported flaws include **CVE-2026-25520**, **CVE-2026-25586**, **CVE-2026-25587**, and **CVE-2026-25641**, described as providing multiple paths to break out of SandboxJS’s isolation guarantees and take over the underlying runtime environment. Technical details published for **CVE-2026-25520** indicate that, prior to *SandboxJS* `0.8.29`, **function return values are not wrapped**, allowing attackers to use `Object.values()`/`Object.entries()` to obtain an array containing the host’s `Function` constructor (e.g., via `Array.prototype.at`), which can then be used to execute code outside the sandbox; the issue is fixed in `0.8.29` (with a referenced upstream commit and GitHub Security Advisory). Additional reported escape vectors include manipulation of supposedly safe prototypes (e.g., overwriting `Map.prototype.has` via a bug in the library’s `let` implementation) and a **host prototype pollution** condition tied to unsafe property-checking logic, collectively undermining the library’s core containment model.
Jun 29, 2026
A wave of disclosures has exposed multiple critical flaws in the Node.js sandbox library **vm2**, showing that untrusted JavaScript can break out of the sandbox and execute commands on the host. GitHub advisories describe several distinct escape paths affecting versions as old as `3.9.6` and, in some cases, up to `3.11.3`, including a breakout through Node.js `inspect`, a Promise species bypass that defeats an earlier patch, prototype pollution through vm2’s bridge to host intrinsic prototypes, and a `NodeVM` misconfiguration path where `nesting: true` lets code bypass `require: false` and load `vm2` recursively to reach modules such as `child_process`. Public proof-of-concepts show attackers recovering the host `process` object and invoking host commands, turning vm2 from a containment boundary into a route to full host compromise. Additional reporting and upstream changes indicate the problems are broader than a single bug. Semgrep documented a new sandbox escape, while vm2 maintainers added regression tests covering descriptor- and prototype-traversal techniques used to recover host constructors such as `Function`, `AsyncFunction`, and `GeneratorFunction`, as well as callback sanitization bypasses tied to Promise handling. A later roundup described five critical vulnerabilities with no practical configuration-based workaround for deployments that execute untrusted code, and urged upgrades to **vm2 `3.11.4` or later**. The advisory backlog on the project’s GitHub page shows a concentrated set of newly published sandbox escape, builtin bypass, and host code execution issues, underscoring that organizations relying on vm2 for isolation should treat affected environments as potentially compromised.
Jun 29, 2026