Sandbox escape via callable constructor path in SandboxJS

CVE-2026-34208 affects SandboxJS, a JavaScript sandboxing library, in versions prior to 0.8.36. SandboxJS is intended to prevent direct assignment to host global objects such as Math.random, but that protection can be bypassed through an exposed callable constructor path using this.constructor.call(target, attackerObject). In the vulnerable condition, this.constructor resolves to the internal SandboxGlobal function, and because Function.prototype.call remains permitted, attacker-controlled code can invoke that path to assign arbitrary properties onto host global objects. Those unauthorized mutations are not confined to a single sandbox execution and can persist across sandbox instances within the same process, breaking sandbox isolation guarantees.