A severe sandbox escape vulnerability has been discovered in the JavaScript library, enabling attackers to execute arbitrary code on host systems. The flaw, tracked as CVE-2026-25881 with a critical CVSS score of 8.3/10, affects all versions up to 0.8.30 and has been patched in version 0.8.31. The vulnerability exploits a weakness in SandboxJS’s protection mechanism. […] The post Critical SandboxJS Vulnerability Allows Remote Host Takeover – PoC Released appeared first on Cyber Security News.