SandboxJS has a sandbox escape via Function.caller leakage of internal call op (CVE-2026-43898) | HOL Guard CVE