AIKIDO-2026-859636

TL;DR

subscript evaluates untrusted expressions against a supplied context and blocks access to constructor, prototype, and __* properties so host capabilities stay out of reach. The pre-fix guard only inspected string keys, so dynamically computed keys, assignment targets, destructuring patterns, object rest and spread, and base-less class declarations bypassed the check and reached host constructors and reflective helpers. Reaching a constructor chain lets an untrusted expression obtain the Function constructor and run arbitrary JavaScript, escaping the sandbox. The fix coerces keys before checking them, guards every access path, drops the default Object binding, and evaluates in a null-prototype context.