Galaxy-sc/CVE-2026-23830-SandBreak

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Go-based exploit generator for CVE-2026-23830 that produces JavaScript payloads to escape the SandboxJS sandbox via the unprotected AsyncFunction constructor, enabling arbitrary command execution on the host.

Backdoor review

No backdoor observed in reviewed code

The repository contains a Go-based exploit generator for CVE-2026-23830. The code generates JavaScript payloads that exploit a sandbox escape vulnerability. No backdoor, concealed harmful behavior, or deceptive payload targeting the person running the PoC was observed. The tool's functionality is consistent with its stated purpose of generating exploit payloads for a known vulnerability.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesGoJavaScript
Target softwareSandboxJS
Attack typesRemote Code ExecutionSandbox Escape
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is an exploit generator that produces JavaScript code designed to exercise the CVE-2026-23830 sandbox escape vulnerability. The README explicitly labels it an 'Exploit Generator & Auto-Pwn Tool' and describes it as exploiting the unprotected AsyncFunction constructor to execute arbitrary code. The Go source constructs payloads that break out of the sandbox and run OS commands (e.g., whoami, calc.exe), which is the definition of exploit code.

README.md:2README.md:8-10CVE-2026-23830.go:66CVE-2026-23830.go:69

Requirements

  • Target must be running a vulnerable version of SandboxJS (< 0.8.26) that does not isolate AsyncFunction.README.md:8-10
  • For OOB mode, an attacker-controlled HTTP/HTTPS listener (e.g., webhook.site) is required to receive exfiltrated command output.CVE-2026-23830.go:50-53

Observed behavior

  • Generates a JavaScript payload that obtains the native AsyncFunction constructor via (async()=>{}).constructor, then uses it to create a function that executes outside the sandbox.CVE-2026-23830.go:66
  • In OOB mode, the payload executes a user-supplied shell command, Base64-encodes the output, and sends it to a specified URL via Node.js http/https module.CVE-2026-23830.go:66
  • In calc mode, the payload spawns calc.exe on Windows as a proof of code execution.CVE-2026-23830.go:69
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Payload Generation
The Go program generates JavaScript payloads that use the AsyncFunction constructor to escape a sandbox and execute arbitrary commands.This is the expected behavior of a PoC for CVE-2026-23830, which describes a sandbox escape via AsyncFunction.CVE-2026-23830.go:66CVE-2026-23830.go:69
Command Execution
The generated payloads execute commands on the target system using child_process.execSync or child_process.spawn.This is the intended exploit behavior for the vulnerability, not a backdoor against the PoC user.CVE-2026-23830.go:66CVE-2026-23830.go:69
Data Exfiltration
In OOB mode, the payload sends command output to a user-supplied URL via HTTP/HTTPS.This is a feature of the exploit tool for blind RCE scenarios, not a hidden exfiltration of the PoC user's data.CVE-2026-23830.go:66
Review boundaries

What the analysis did not establish

  • The evidence includes only the exploit generator source code and README; no demonstration of successful exploitation or target environment is provided.
  • The README references a video demonstration (line 66) that is not included in the evidence.
  • Only the two text files (CVE-2026-23830.go and README.md) were reviewed. No binary files were present or analyzed.
  • The review does not assess the safety of executing the generated JavaScript payloads on a target system, only whether the PoC itself contains a backdoor against the user.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1