--- sourceDocument: Australia Platform security sourceDocumentLink: https://www.servicenow.com/docs/r/australia/platform-security Release : - australia ft:locale : - en-US ft:publication_title : - Australia Platform security ft:clusterId : - psec bundleId : - psec workflow : - Platform --- # Enable script sandbox \[Updated in Security Center 1.3\] # Enable script sandbox \[Updated in Security Center 1.3\] {#ariaid-title1} Release version: Australia Updated March 12, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Enable script sandbox \[Updated in Security Center 1.3\] Thescript sandboxis a critical security feature in ServiceNow that restricts the execution of client-generated scripts on the server by running them in a controlled environment with limited rights. This prevents unauthorized or unauthenticated users from executing privileged scripts that could compromise the instance's security. The feature can be enabled by setting theglide.script.use.sandboxsystem property totrue, which is a one-way, non-revertible change. Show full answer Show less ## Key Features * Executes client-generated scripts, such as query conditions and GlideAjax expressions, within a secure sandbox environment. * Restricts access to only business rules marked as **Client callable** and script includes marked as **Sandbox enabled**. * Limits API calls, especially those involving direct database access; for example, data modification commands like `current.update()` are ignored. * Prevents unauthorized CRUD operations through client-side JavaScript queries by enforcing strict validation and sanitization. * Applies specifically to scripts evaluated from filters, queries, and certain ServiceNow AI Platform functions. * Beginning with the Xanadu release, script includes must be marked as **Sandbox enabled** to be accessible inside the sandbox; previous **Client callable** designations are no longer sufficient. ## Why It Matters Without enabling the script sandbox, client-generated scripts can run with full privileges, posing a significant security risk by potentially exposing or modifying sensitive data. Enabling the sandbox mitigates this risk by enforcing permissions and preventing data manipulation from scripts originating on the client side. ## Practical Impact and Considerations * Once enabled, this property cannot be reversed, so plan accordingly before implementation. * Customers with customizations involving hard-coded JavaScript queries that perform create, read, update, or delete (CRUD) operations may need to review and adjust their scripts to comply with sandbox restrictions. * The feature is set to **true** by default in the Australia release, reflecting its importance for platform security. ## Related Security Properties * `glide.script.allow.ajaxevaluate`: Controls the evaluation of AJAX scripts. * `glide.script.secure.ajaxgliderecord`: Enforces access control on AJAX GlideRecord calls. ## Next Steps for ServiceNow Customers * Enable the script sandbox by setting `glide.script.use.sandbox` to **true** via System Properties for enhanced security. * Audit any client-side scripts and filter queries to ensure compatibility with sandbox restrictions. * Mark necessary script includes as **Sandbox enabled** to maintain required functionality within the sandbox environment. * Review related security properties to strengthen script execution controls. Use the glide.script.use.sandbox property to enable script sandboxing. Prevent unauthorized or unauthenticated users from executing privileged script on your instance by enabling the script sandbox feature. The script sandbox is used to execute client-generated scripts, such as query conditions and GlideAjax expressions, in a "sandbox" environment that has restricted rights. Without the script sandbox, unauthorized/unauthenticated users can execute privileged script on an instance. This can impact security across all areas, including, but not limited to potentially malicious access to all data on the instance. Enable the script sandbox feature on your instance by setting the glide.script.use.sandbox system property to true. Warning: This is a safe harbor property, meaning the value can't be altered once it's changed. It is non-revertible. There are two cases in the ServiceNow AI Platform that enable the client to send scripts to the server for evaluation: Filters or queries : It is legal to send a filter to the server such as `assigned_to=JavaScript:getMyGroups()`. System API : API call enables the client to run arbitrary scripts on the server and receive a response. If you enable the script sandbox, the script being evaluated at either of these two entry points runs in a sandbox with reduced rights, with the following characteristics: * Only those business rules marked Client callable are available within the sandbox. * Only script includes marked Sandbox enabled are available within the sandbox. * Certain API calls (largely, but not entirely, limited to ones dealing with direct DB access are not allowed.) * You can't insert, update, or delete data from within the sandbox. For example, any calls to `current.update()`, are ignored. If you run the ServiceNow AI Platform without enabling script sandboxing, none of these restrictions apply. {#sc-client-generated-scripts-sandbox__ul_ty4_zgk_jkb} Note: Beginning with the Xanadu release, script includes marked as Glide AJAX enabled (previously named Client callable) aren't accessible within the sandbox. Only those marked Sandbox enabled are available within the sandbox. When upgrading to the Australia release from the Washington DC release or earlier, any script includes marked as Client callable are also marked as Sandbox enabled. ## More information {#sc-client-generated-scripts-sandbox__section_more_information} {#sc-client-generated-scripts-sandbox__table_ajc_b43_3kb__entry__2} | Attribute | Description | |-|-| | Property name | glide.script.use.sandbox | | Configuration type | System Properties (/sys_properties_list.do) | | Category | [Validation, sanitization, and encoding](https://www.servicenow.com/docs/qvFon3mPY~i4OtLtQVS_QQ "Validation, sanitization, and encoding addresses input validation to prevent against vulnerabilities like Cross-Site Scripting (XSS), SQL injection and other attacks.") | | Purpose | Enforces validation for the client-side JavaScript queries that are launched against the platform | | Recommended value | true | | Default value | true | | Security risk rating | 10 | | Functional impact | This remediation enforces validation for the client-side JavaScript queries that are launched against the ServiceNow AI Platform. There is a potential impact if customer has customizations that include hard-coded JavaScript queries to perform CRUD operations. | | Security risk | (Critical) The ServiceNow AI Platform provides wide variety of features and functionality through JavaScript queries. However, without appropriate authorization and validation, there is a potential for an attacker to perform unauthorized operations against the platform. | | References | glide.script.use.sandbox belongs to the same family of properties that secure and restrict execution of scripts originating from the client: * glide.script.allow.ajaxevaluate: See [Disable AJAXEvaluate](https://www.servicenow.com/docs/_PA~rzpQ74khK5PFE55KRg "Use the glide.script.allow.ajaxevaluate to protect the system API from vulnerabilities of Client script execution through AJAX calls."). * glide.script.secure.ajaxgliderecord: See [Require AJAXGlideRecord ACL checking](https://www.servicenow.com/docs/WkQHjGj3hSSyAxRkCAGf_Q "Use the glide.script.secure.ajaxgliderecord property to perform access control rule (ACL) validation when server-side records, such as tables, are accessed using GlideAjax APIs within a client script."). {#sc-client-generated-scripts-sandbox__ul_bpq_vvq_nkb} | [ ] {#sc-client-generated-scripts-sandbox__table_ajc_b43_3kb} To learn more about adding or creating a system property, see [Add a system property](https://www.servicenow.com/docs/access?context=t_AddAPropertyUsingSysPropsList&version=australia&pubname=australia-platform-administration&ft:locale=en-US).