CVE-2026-32723
Execution-Quota Bypass in SandboxJS Timers via Shared Tick State
Publication date: 2026-03-18
Last updated on: 2026-03-19
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| nyariv | sandboxjs | to 0.8.35 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-362 | The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in SandboxJS, a JavaScript sandboxing library, in versions prior to 0.8.35. The issue is related to how timers are handled within the sandbox environment. Specifically, a global tick state called `currentTicks.current` is shared between different sandboxes. When timer string handlers are compiled at execution time, they use this global tick state instead of the tick object of the sandbox that scheduled the timer.
In scenarios where multiple sandboxes run concurrently (multi-tenant), another sandbox can overwrite the global tick state between the scheduling and execution of a timer. This causes the timer callback to run under a different sandbox's tick budget, effectively bypassing the original sandbox's execution quota or watchdog mechanism.
This means that the intended limits on execution time or resource usage for a sandbox can be circumvented, allowing code to run longer or consume more resources than intended. The issue was fixed in version 0.8.35 of SandboxJS.
How can this vulnerability impact me? :
This vulnerability can allow code running inside one sandbox to bypass its execution quota or watchdog timer by exploiting the shared global tick state. As a result, malicious or buggy code could consume more CPU time or resources than intended, potentially leading to performance degradation or denial of service within the environment hosting multiple sandboxes.
In multi-tenant or concurrent sandbox scenarios, this could allow one tenant's code to interfere with the resource limits of another, undermining isolation guarantees and potentially leading to security or stability issues.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade SandboxJS to version 0.8.35 or later, where the issue with timer execution-quota bypass has been fixed.