diff --git a/msa/js-executor/api/jsExecutor.ts b/msa/js-executor/api/jsExecutor.ts
index 855ad99932..ab916a2760 100644
--- a/msa/js-executor/api/jsExecutor.ts
+++ b/msa/js-executor/api/jsExecutor.ts
@@ -15,14 +15,22 @@
 ///
 
 import vm, { Script } from 'vm';
+import { _logger } from '../config/logger';
 
 export type TbScript = Script | Function;
 
 export class JsExecutor {
     useSandbox: boolean;
+    private logger = _logger('JsExecutor');
 
     constructor(useSandbox: boolean) {
         this.useSandbox = useSandbox;
+        if (!useSandbox) {
+            this.logger.warn(
+                'script.use_sandbox=false: dangerous by design — user-supplied scripts run in the host realm with no isolation. ' +
+                'Use only as a performance trade-off in trusted, non-public clusters.'
+            );
+        }
     }
 
     compileScript(code: string): Promise<TbScript> {
@@ -56,9 +64,15 @@ export class JsExecutor {
     private invokeScript(script: Script, args: string[], timeout: number | undefined): Promise<any> {
         return new Promise((resolve, reject) => {
             try {
-                const sandbox = Object.create(null);
-                sandbox.args = args;
-                const result = script.runInNewContext(sandbox, {timeout: timeout});
+                const sandbox = vm.createContext(Object.create(null));
+                // Construct args inside the sandbox context so it inherits sandbox-realm
+                // prototypes; prevents prototype-based escapes from the host realm.
+                const ctxArgs = vm.runInContext('[]', sandbox) as string[];
+                for (let i = 0; i < args.length; i++) {
+                    ctxArgs[i] = String(args[i]);
+                }
+                sandbox.args = ctxArgs;
+                const result = script.runInContext(sandbox, {timeout: timeout});
                 resolve(result);
             } catch (err) {
                 reject(err);
@@ -67,6 +81,11 @@ export class JsExecutor {
     }
 
 
+    // DANGEROUS BY DESIGN: the non-sandbox path. vm.compileFunction's
+    // parsingContext only isolates *parsing*, not *execution* — the resulting
+    // function runs in the host realm with full access to host globals
+    // (process, require, etc.). Enabled only via script.use_sandbox=false as
+    // a performance trade-off in trusted clusters.
     private createFunction(code: string): Promise<Function> {
         return new Promise((resolve, reject) => {
             try {
diff --git a/msa/js-executor/config/default.yml b/msa/js-executor/config/default.yml
index 5939b0e29a..9a33190069 100644
--- a/msa/js-executor/config/default.yml
+++ b/msa/js-executor/config/default.yml
@@ -50,6 +50,12 @@ logger:
   filename: "tb-js-executor-%DATE%.log"
 
 script:
+  # WARNING: setting this to "false" is DANGEROUS BY DESIGN. The non-sandbox
+  # path compiles and runs user-supplied scripts in the host realm via
+  # vm.compileFunction; it provides no isolation and exposes the host process
+  # (file system, environment variables, child_process, etc.) to script
+  # authors. Use "false" only as a performance trade-off in trusted,
+  # non-public clusters where every script author is fully trusted.
   use_sandbox: "true"
   memory_usage_trace_frequency: "1000"
   script_body_trace_frequency: "10000"