Critical SandboxJS Escape Vulnerability Enables Host Takeover

A critical CVE-2026-43898 sandbox escape in the npm package @nyariv/sandboxjs (≤ 0.9.5) lets sandboxed code leak an internal LispType.Call callback, chain forged calls to obtain the host Function constructor, and achieve full remote code execution on the host. GitHub researchers and the reporter provided a working proof-of-concept; the issue is fixed in version 0.9.6 and users running untrusted JavaScript through affected versions are urged to update immediately.