CVE-2026-22686: Sandbox Escape via Host Error Prototype Chain in enclave-vm

Overview

Enclave is a JavaScript sandbox intended for running untrusted code produced by AI agents. The record describes a sandbox escape in enclave-vm in which a failed tool invocation exposes a host-side Error object to sandboxed code. That object keeps the host realm prototype chain, so the sandboxed code can reach host-side capabilities. The record states the issue is fixed in 2.7.0.

Impact

• Untrusted code running inside the sandbox may execute arbitrary code in the host Node.js runtime, according to the record.
• The record lists access to sensitive resources such as process.env, the filesystem and the network as possible consequences.
• The record states this breaks the core isolation guarantee of enclave-vm. The CVSS base score is 10 and the CWE is CWE-94 (Code Injection).

Affected products and versions

• Product: Agentfront Enclave (enclave-vm).
• Affected: all versions before 2.7.0, according to the record.
• Fixed: 2.7.0, according to the record.
• The record does not list any version between the affected range and the fix.

Exploitation status

The CISA KEV catalog entry in the record is marked as not listed, so no active exploitation is confirmed by that source. The record marks SSVC exploitation as proof of concept and automatable as yes. The NVD reference list tags the vendor advisory with Exploit, but this does not confirm exploitation in the wild. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

• Upgrade enclave-vm to 2.7.0 or later, which the record identifies as the fixed version.
• Review the vendor advisory and the linked commit for the fix details and any interim mitigation guidance.
• Until upgrades are complete, restrict which untrusted code can run in affected sandboxes and limit the secrets and network access available to the host process.
• Treat the host process as exposed if untrusted code ran in an affected version, and review logs for unexpected activity.

Detection guidance

• Monitor for sandboxed workloads that trigger frequent tool invocation failures, since the record ties the exposure to failed tool calls.
• Review application logs for unexpected host-side code execution, access to environment variables, or unusual filesystem and network activity originating from the Node.js process.
• Confirm the deployed enclave-vm version in dependency manifests and lockfiles to identify instances still before 2.7.0.

Limitations of the available information

• The record does not provide technical reproduction details, and this analysis does not include them.
• The record does not state whether the fix in 2.7.0 has been independently verified.
• The record does not describe any compensating controls beyond the advisory reference.
• Whether any deployment has already been compromised is unknown from the available sources.

Frequently asked questions

What is CVE-2026-22686?

It is a critical sandbox escape in enclave-vm, the JavaScript sandbox from the Enclave project, which the record says lets untrusted sandboxed code run code in the host Node.js runtime.

Which versions are affected?

According to the record, versions before 2.7.0 are affected, and the record states the issue is fixed in 2.7.0.

Is this vulnerability being actively exploited?

The CISA KEV entry in the record is not listed, and no confirmed exploitation appears in the sources consulted. Organizations should still treat it as high priority because of its critical score.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.