Read the docs
TI-2026-18213 Aliases CVE-2026-22686GHSA-7qm7-455j-5p63

Sandbox Escape via Host Error Prototype Chain in enclave-vm

Priority HIGH 82CWE-693Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass, Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-693 and CWE-94.

Summary

Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to 2.7.0, there is a critical sandbox escape vulnerability in enclave-vm that allows untrusted, sandboxed JavaScript code to execute arbitrary code in the host Node.js runtime. When a tool invocation fails, enclave-vm exposes a host-side Error object to sandboxed code. This Error object retains its host realm prototype chain, which can be traversed to reach the host Function constructor. An attacker can intentionally trigger a host error, then climb the prototype chain. Using the host Function constructor, arbitrary JavaScript can be compiled and executed in the host context, fully bypassing the sandbox and granting access to sensitive resources such as process.env, filesystem, and network. This breaks enclave-vm’s core security guarantee of isolating untrusted code. This vulnerability is fixed in 2.7.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00753 55th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed enclave (agentfront): 2.7.0enclave-vm (npm): 2.7.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
agentfrontenclavebefore 2.7.02.7.0Patch availableCNA
—enclave-vm (npm)before 2.7.02.7.0Patch availableGHSA-7qm7-455j-5p63
  • enclave Vendoragentfront Affected before 2.7.0 Fixed in 2.7.0 Patch available CNA
  • enclave-vm (npm) Vendor— Affected before 2.7.0 Fixed in 2.7.0 Patch available GHSA-7qm7-455j-5p63

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:agentfront:enclave:*:*:*:*:*:node.js:*:*before 2.7.0Vulnerableagentfront
  • cpe:2.3:a:agentfront:enclave:*:*:*:*:*:node.js:*:* Versions before 2.7.0 Vulnerable ·agentfront

Remediation

  • Fix · CNA enclave (agentfront) Fixed in 2.7.0
  • Fix · GHSA-7qm7-455j-5p63 enclave-vm (npm) Fixed in 2.7.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-22686
  2. 2026-10-03 Alias added: GHSA-7qm7-455j-5p63

References

Exploit 1

Patch 1

Advisory 1

Other 1

  • TI-2026-21983 @enclave-vm/core is vulnerable to Sandbox Escape CVSS 3.1CRITICAL 10.0
  • TI-2026-20642 Enclave has a sandbox escape via infinite recursion and error objects CVSS 4.0MEDIUM 6.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences