https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-34217.htmlhttps://patchthecve.com/cve/CVE-2026-34217.htmlMon, 26 Oct 2026 22:10:00 +0000HIGH 7.2: SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, a scope modification vulnerability exists in @nyariv/sandboxjs. The vulnerability allows untrusted sandboxed code to leak internal interpreter objects through the new operator, exposing sandbox scope objects in the scope hierarchy to unthttps://patchthecve.com/cve/CVE-2026-34211.htmlhttps://patchthecve.com/cve/CVE-2026-34211.htmlMon, 26 Oct 2026 22:10:00 +0000HIGH 7.5: SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, the @nyariv/sandboxjs parser contains unbounded recursion in the restOfExp function and the lispify/lispifyExpr call chain. An attacker can crash any Node.js process that parses untrusted input by supplying deeply nested expressions (e.ghttps://patchthecve.com/cve/CVE-2026-34208.htmlhttps://patchthecve.com/cve/CVE-2026-34208.htmlMon, 26 Oct 2026 22:10:00 +0000CRITICAL 10.0: SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, SandboxJS blocks direct assignment to global objects (for example Math.random = ...), but this protection can be bypassed through an exposed callable constructor path: this.constructor.call(target, attackerObject). Because this.construct