Sandbox escape in @nyariv/sandboxjs via TOCTOU key coercion

CVE-2026-25641 is a sandbox escape vulnerability in SandboxJS (@nyariv/sandboxjs) affecting versions 0.8.28 and earlier. The flaw is caused by a mismatch between the property key validated by the sandbox and the key ultimately used for property access. SandboxJS performs validation on a key assuming string semantics, but does not enforce that the supplied key is actually a primitive string. As a result, an attacker can supply a malicious object with coercion behavior such that it yields one string value during the safety check, for example when evaluated through hasOwnProperty(key), and a different string value when later used for the actual property access. This creates a time-of-check to time-of-use condition in key handling, allowing a key to appear benign during validation and resolve to a dangerous property such as proto during use. In the context of SandboxJS, this can be leveraged to bypass property restrictions, escape the sandbox, and potentially reach host-side code execution paths.