Sandbox Escape via Host Error Prototype Chain in enclave-vm

Description

Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to 2.7.0, there is a critical sandbox escape vulnerability in enclave-vm that allows untrusted, sandboxed JavaScript code to execute arbitrary code in the host Node.js runtime. When a tool invocation fails, enclave-vm exposes a host-side Error object to sandboxed code. This Error object retains its host realm prototype chain, which can be traversed to reach the host Function constructor. An attacker can intentionally trigger a host error, then climb the prototype chain. Using the host Function constructor, arbitrary JavaScript can be compiled and executed in the host context, fully bypassing the sandbox and granting access to sensitive resources such as process.env, filesystem, and network. This breaks enclave-vm’s core security guarantee of isolating untrusted code. This vulnerability is fixed in 2.7.0.

Scores

EPSS (exploitation in 30 days)

0.75% · top 45% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: poc · Automatable: yes · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 10.0.

Weakness

• CWE-693: Protection Mechanism Failure (opens in a new tab)All about CWE-693 and its CVEs
• CWE-94: Improper Control of Generation of Code ('Code Injection') (opens in a new tab)All about CWE-94 and its CVEs

Affected products

• agentfront · enclave

  • affected < 2.7.0

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• npmenclave-vmGHSA-7qm7-455j-5p63 (opens in a new tab)

References (2)

• https://github.com/agentfront/enclave/security/advisories/GHSA-7qm7-455j-5p63 (opens in a new tab)x_refsource_CONFIRM
• https://github.com/agentfront/enclave/commit/ed8bc438b2cd6e6f0b5f2de321e5be6f0169b5a1 (opens in a new tab)x_refsource_MISC

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-7qm7-455j-5p63 (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-22686](https://trackcve.app/badge/CVE-2026-22686.svg)](https://trackcve.app/cve/CVE-2026-22686)

Record last updated 14 Jan 2026, 14:33 UTC.