# Sandbox eval without policy gate

Script engine or exec/vm eval of user code with no class filter, builtins restriction, or policy gate

_Area: Web injection and code execution. Seen in 3 disclosed reports; latest 2026-10-06. Updated 2026-10-24._

## How it works
A feature evaluates user-supplied code (scripts, algorithms, flow components, request payloads) inside an embedded engine or in-process `eval`/`exec`/`vm`. The code assumes the engine is a sandbox. It is not: the engine either exposes host classes/functions by default, or the wrapper that was supposed to restrict it is incomplete. The broken assumption is that "we passed an allow-list / used a sandbox API" equals "user code cannot reach the host." In practice the default reachability of host primitives (Java classes, `__builtins__`, host `Function`) is what decides safety, not the presence of a sandbox call.

## Where to show up
- `getScriptEngine()` / `ScriptEngine.eval` with no `ClassFilter` (Nashorn, Rhino, Groovy) [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-vmwp-vh32-rj75.md)
- `exec()`/`eval()` globals built from an allow-list but `__builtins__` never set [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-8qpj-27x8-pwpq.md)
- `vm.runInNewContext` whose context object includes any host-realm function (e.g. `util.format`) [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-6vr3-7wcx-v5g5.md)
- "Edit script" / algorithm-override / custom-component endpoints reachable by lower-privileged users
- Auth checks present on sibling handlers but missing on the eval handler [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-6vr3-7wcx-v5g5.md)
- A server-policy / feature-flag gate that is never consulted before execution [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-8qpj-27x8-pwpq.md)

## How to review
Trace every path from user input to an eval primitive. The invariant: user code must not be able to obtain any host-realm constructor, class loader, or builtins object. Concretely check:
- Is a `ClassFilter` (or equivalent) actually passed to the engine factory? [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-vmwp-vh32-rj75.md)
- Are `__builtins__` explicitly set to a restricted mapping in exec globals? [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-8qpj-27x8-pwpq.md)
- Does the vm context contain only primitives, never host functions? [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-6vr3-7wcx-v5g5.md)
- Is there a policy gate consulted before execution, and is it enforced server-side? [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-8qpj-27x8-pwpq.md)
- Does the eval endpoint require the same auth as privileged siblings? [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-6vr3-7wcx-v5g5.md)
If any answer is no, treat as unsafe regardless of allow-lists.

## Variants seen
- Java Nashorn engine without ClassFilter, reached via algorithm override [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-vmwp-vh32-rj75.md)
- Python in-process REPL with implicit full builtins, bypassing import allow-list [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-8qpj-27x8-pwpq.md)
- Node `vm` context leaking host `Function` via a utility function [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-6vr3-7wcx-v5g5.md)

## Why fixes fail
Allow-lists that omit `__builtins__` silently restore `__import__`/`open`/`eval` [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-8qpj-27x8-pwpq.md); adding a sandbox API without a filter or restricted context leaves host reachability intact [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-vmwp-vh32-rj75.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-6vr3-7wcx-v5g5.md).

## Impact and severity
All three led to remote code execution on the server, including unauthenticated [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-6vr3-7wcx-v5g5.md) and privilege escalation to superuser [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-8qpj-27x8-pwpq.md). Severity is high to critical; it worsens when the eval path is unauthenticated or reachable by any authenticated editor, and when the engine exposes host classes by default.

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-vmwp-vh32-rj75.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-8qpj-27x8-pwpq.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-6vr3-7wcx-v5g5.md