# Sandboxed code reaches host globals

Sandbox allowlists exposing process-global singletons or mutating functions that bridge live host state

_Area: Memory corruption and native code. Seen in 3 disclosed reports; latest 2026-10-01. Updated 2026-11-01._

## How it works
A sandbox exposes host modules to untrusted code through a read-only proxy, assuming that blocking property writes keeps the host safe. That assumption breaks because a proxy guards property access, not the internal state that host functions and EventEmitter methods mutate when called. A process-global singleton (an agent, a trust store, a symbol registry) is shared by every request in the process, so a sandbox that can call a method on it reaches live host objects and process-wide settings. The boundary is crossed by a call, not an assignment.

## Where it shows up
- Builtin allowlists that expose modules with process-global singletons: `https.globalAgent`, shared pools, caches, default trust stores.
- Read-only proxies wrapping host modules where methods like `.on()` mutate the real EventEmitter.
- Dangerous-builtin blocklists that classify one module (e.g. `dns` for `setServers`) but miss an equivalent setter in another (`tls.setDefaultCACertificates`).
- Cross-realm magic symbols (`Symbol.for('nodejs.*')`) where only some are blocked, and proxy traps that check symbols in `get`/`ownKeys` but not `set`/`defineProperty`/`deleteProperty`.
- Host-realm arrays or objects unwrapped to satisfy native type checks.

## How to review
For every module a sandbox may require, enumerate each exported function and check for process-wide side effects, not just property writes. The invariant: no sandbox-reachable call may mutate state shared with host workloads, and no host object handed to the sandbox may carry live sockets, request options, or credentials. For symbol defenses, verify every proxy trap enforces the same blocklist, and that the blocklist covers the full set of Node.js internal symbols, not a sample.

## How finders spotted it
- Recognized that read-only proxies are insufficient for process-global EventEmitters whose methods mutate internal state; noted `https.globalAgent` is the default agent for host requests and its `free` event exposes socket and request options [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-h85j-hv3c-qfgq.md).
- Noted the blocklist rejects `dns` for process-wide mutation but not `tls`, then found the proxy blocks assignment but not function calls, and that `URLSearchParams.getAll()` yields a host-realm array the bridge unwraps [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-98xx-8mx4-x7cm.md).
- Code review of the `Symbol.for` override noticing only 2 of 9 `nodejs.*` symbols blocked, then comparing traps to find `get`/`ownKeys` check the symbol but `set`/`defineProperty`/`deleteProperty` do not [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-m5q2-4fm3-vfqp.md).

## Variants seen
- Live host EventEmitter bridging sockets and request options into the sandbox [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-h85j-hv3c-qfgq.md).
- Process-wide setter replacing the host TLS trust store [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-98xx-8mx4-x7cm.md).
- Incomplete cross-realm symbol blocklist plus missing trap checks hijacking host `util.promisify` behavior [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-m5q2-4fm3-vfqp.md).

## Impact and severity
Cross-tenant boundary crossing when sandboxes share a process: theft of host bearer tokens and plaintext TLS responses [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-h85j-hv3c-qfgq.md), MITM of all host HTTPS clients lacking explicit `ca` plus DoS from removed roots [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-98xx-8mx4-x7cm.md), and bypass of host-side validation when chained with promisified or stream type checks [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-m5q2-4fm3-vfqp.md). Impact rises with process sharing and with how many host clients rely on the mutated global.

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-h85j-hv3c-qfgq.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-98xx-8mx4-x7cm.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-m5q2-4fm3-vfqp.md