CVE-2026-116811: Js Sandbox Escape Function Constructor Accesscve-2026-116811-js-sandbox-escape-function-constructor-access
Untrusted template code is compiled or evaluated with Function/eval in the host realm instead of a hardened VM realm. Compiling a stored template with new Function() in the worker's own realm, and handing it the host payload object by reference, lets $payload.constructor.constructor resolve to the host Function constructor and execute arbitrary code (sandbox
