SandboxJS Patches Maximum-Severity Flaw Threatening AI Agent and Isolated-Execution Security

SandboxJS is an open-source JavaScript sandbox library commonly used by AI agents and code-execution platforms to isolate untrusted code. If its security boundary is breached, attackers could take control of the host environment, directly threatening automated services and infrastructure that use the component.

SandboxJS recently patched a critical vulnerability tracked as CVE-2026-43898, which carries the maximum CVSS score of 10.0. Attackers could exploit the flaw to escape the sandbox and execute arbitrary code. Affected users should immediately upgrade to version 0.9.6 and check whether their AI agents or code-execution services have processed untrusted input.