CVE-2026-27597: Agentfront Enclave (@enclave-vm/core) Sandbox Escape Leading to Remote Code Execution
The Enclave JavaScript sandbox, used to run AI agent code, has a sandbox escape in @enclave-vm/core before 2.11.1 that the record links to remote code execution. The GitHub CNA scored it critical (CVSS 10). The sources consulted show no confirmed active exploitation, and the fix is version 2.11.1.
Overview
The Enclave project provides a secure JavaScript sandbox for running code produced by AI agents. According to the record, the @enclave-vm/core package from Agentfront allows an escape from the security boundaries it sets, which can be used to achieve remote code execution. The weakness is classified as CWE-94 (Code Injection). The fix is in version 2.11.1.
Impact
- The record states that the escape can be used to achieve remote code execution.
- The GitHub CNA assigned a CVSS score of 10 (critical). The vector describes a network attack that needs low complexity, no privileges and no user interaction, with a changed scope and high impact on confidentiality, integrity and availability.
- The EPSS probability in the record is about 1.1 percent, which is a statistical estimate and not evidence of exploitation.
- The SSVC exploitation field in the record is set to poc, which indicates a proof-of-concept level and not confirmed attacks.
Affected products and versions
- Product: Agentfront Enclave, package @enclave-vm/core.
- Affected: versions before 2.11.1.
- Fixed: version 2.11.1, according to the record and the vendor advisory.
Exploitation status
The CISA KEV catalog does not list this CVE in the record, so no active exploitation in the wild is confirmed by the sources consulted. The reference list includes an entry tagged as Exploit, but this record does not describe any observed attacks.
Remediation and mitigation
- Upgrade @enclave-vm/core to version 2.11.1 or later. The commit contains the patch.
- Review the vendor advisory for the mitigation guidance it provides until the upgrade is complete.
- Treat any code from AI agents as untrusted and restrict the host privileges and secrets reachable from the sandbox.
Detection guidance
- Inventory all projects and services that depend on @enclave-vm/core and record their installed versions.
- Monitor for unexpected child processes, outbound connections or file access originating from services that run the sandbox.
- Review logs of agent code execution for unusual patterns at a high level.
Limitations of the available information
The record does not describe the technical mechanism of the escape, the affected components in detail, or any proof-of-concept beyond the SSVC and reference tags. It gives no further affected versions beyond the upper bound of 2.11.1. Whether any deployments were compromised is unknown.
Frequently asked questions
What is affected by CVE-2026-27597?
The @enclave-vm/core package from Agentfront Enclave, in versions before 2.11.1, according to the record.
Which version fixes the issue?
The record states the issue is fixed in version 2.11.1. Upgrading to that version or later is the recommended action.
Is this vulnerability being actively exploited?
The CISA KEV catalog does not list it in this record, and no confirmed active exploitation appears in the sources consulted.
What is the severity?
The GitHub CNA scored it 10 on the CVSS scale and classified it as critical, with high impact on confidentiality, integrity and availability.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.