AIKIDO-2026-10190

TL;DR

Affected versions of this package allow sandbox escape due to multiple isolation bypasses involving Promise static method stealing, Reflect.construct species manipulation, and sensitive object exposure via util.inspect. These flaws break execution boundaries and may expose internal references or privileged contexts. An attacker could exploit this by executing crafted code inside the sandbox that manipulates Promise behavior, abuses proxy handlers, or leverages inspection mechanisms to access objects outside the restricted environment, ultimately achieving arbitrary code execution or privilege escalation.