CVE-2026-22686

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22686", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-08T19:23:09.854Z", "datePublished": "2026-01-13T23:11:49.098Z", "dateUpdated": "2026-01-14T14:33:18.579Z"}, "containers": {"cna": {"title": "Sandbox Escape via Host Error Prototype Chain in enclave-vm", "problemTypes": [{"descriptions": [{"cweId": "CWE-693", "lang": "en", "description": "CWE-693: Protection Mechanism Failure", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/agentfront/enclave/security/advisories/GHSA-7qm7-455j-5p63", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/agentfront/enclave/security/advisories/GHSA-7qm7-455j-5p63"}, {"name": "https://github.com/agentfront/enclave/commit/ed8bc438b2cd6e6f0b5f2de321e5be6f0169b5a1", "tags": ["x_refsource_MISC"], "url": "https://github.com/agentfront/enclave/commit/ed8bc438b2cd6e6f0b5f2de321e5be6f0169b5a1"}], "affected": [{"vendor": "agentfront", "product": "enclave", "versions": [{"version": "< 2.7.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-13T23:11:49.098Z"}, "descriptions": [{"lang": "en", "value": "Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to 2.7.0, there is a critical sandbox escape vulnerability in enclave-vm that allows untrusted, sandboxed JavaScript code to execute arbitrary code in the host Node.js runtime. When a tool invocation fails, enclave-vm exposes a host-side Error object to sandboxed code. This Error object retains its host realm prototype chain, which can be traversed to reach the host Function constructor. An attacker can intentionally trigger a host error, then climb the prototype chain. Using the host Function constructor, arbitrary JavaScript can be compiled and executed in the host context, fully bypassing the sandbox and granting access to sensitive resources such as process.env, filesystem, and network. This breaks enclave-vm\u2019s core security guarantee of isolating untrusted code. This vulnerability is fixed in 2.7.0."}], "source": {"advisory": "GHSA-7qm7-455j-5p63", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-14T14:32:20.627819Z", "id": "CVE-2026-22686", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-14T14:33:18.579Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22686", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-14T14:32:20.627819Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-14T14:33:09.645Z"}}], "cna": {"title": "Sandbox Escape via Host Error Prototype Chain in enclave-vm", "source": {"advisory": "GHSA-7qm7-455j-5p63", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 10, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "agentfront", "product": "enclave", "versions": [{"status": "affected", "version": "< 2.7.0"}]}], "references": [{"url": "https://github.com/agentfront/enclave/security/advisories/GHSA-7qm7-455j-5p63", "name": "https://github.com/agentfront/enclave/security/advisories/GHSA-7qm7-455j-5p63", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/agentfront/enclave/commit/ed8bc438b2cd6e6f0b5f2de321e5be6f0169b5a1", "name": "https://github.com/agentfront/enclave/commit/ed8bc438b2cd6e6f0b5f2de321e5be6f0169b5a1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to 2.7.0, there is a critical sandbox escape vulnerability in enclave-vm that allows untrusted, sandboxed JavaScript code to execute arbitrary code in the host Node.js runtime. When a tool invocation fails, enclave-vm exposes a host-side Error object to sandboxed code. This Error object retains its host realm prototype chain, which can be traversed to reach the host Function constructor. An attacker can intentionally trigger a host error, then climb the prototype chain. Using the host Function constructor, arbitrary JavaScript can be compiled and executed in the host context, fully bypassing the sandbox and granting access to sensitive resources such as process.env, filesystem, and network. This breaks enclave-vm\u2019s core security guarantee of isolating untrusted code. This vulnerability is fixed in 2.7.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-693", "description": "CWE-693: Protection Mechanism Failure"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-13T23:11:49.098Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22686", "state": "PUBLISHED", "dateUpdated": "2026-01-14T14:33:18.579Z", "dateReserved": "2026-01-08T19:23:09.854Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-13T23:11:49.098Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "enclave", "vendor": "agentfront", "versions": [{"status": "affected", "version": "< 2.7.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:agentfront:enclave:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "1F1DF281-9FD8-41F0-A35B-50C6F5449734", "versionEndExcluding": "2.7.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to 2.7.0, there is a critical sandbox escape vulnerability in enclave-vm that allows untrusted, sandboxed JavaScript code to execute arbitrary code in the host Node.js runtime. When a tool invocation fails, enclave-vm exposes a host-side Error object to sandboxed code. This Error object retains its host realm prototype chain, which can be traversed to reach the host Function constructor. An attacker can intentionally trigger a host error, then climb the prototype chain. Using the host Function constructor, arbitrary JavaScript can be compiled and executed in the host context, fully bypassing the sandbox and granting access to sensitive resources such as process.env, filesystem, and network. This breaks enclave-vm\u2019s core security guarantee of isolating untrusted code. This vulnerability is fixed in 2.7.0."}, {"lang": "es", "value": "Enclave es un sandbox seguro de JavaScript dise\u00f1ado para la ejecuci\u00f3n segura de c\u00f3digo de agentes de IA. Antes de la versi\u00f3n 2.7.0, existe una vulnerabilidad cr\u00edtica de escape de sandbox en enclave-vm que permite que c\u00f3digo JavaScript no confiable y en el sandbox ejecute c\u00f3digo arbitrario en el entorno de ejecuci\u00f3n de Node.js del host. Cuando falla la invocaci\u00f3n de una herramienta, enclave-vm expone un objeto Error del lado del host al c\u00f3digo en el sandbox. Este objeto Error conserva su cadena de prototipos del \u00e1mbito del host, la cual puede ser recorrida para alcanzar el constructor Function del host. Un atacante puede desencadenar intencionalmente un error del host y luego escalar la cadena de prototipos. Utilizando el constructor Function del host, se puede compilar y ejecutar JavaScript arbitrario en el contexto del host, eludiendo completamente el sandbox y otorgando acceso a recursos sensibles como process.env, el sistema de archivos y la red. Esto rompe la garant\u00eda de seguridad central de enclave-vm de aislar el c\u00f3digo no confiable. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 2.7.0."}], "id": "CVE-2026-22686", "lastModified": "2026-06-17T10:20:14.003", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22686", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-14T14:32:20.627819Z", "version": "2.0.3"}}]}, "published": "2026-01-14T00:15:49.957", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/agentfront/enclave/commit/ed8bc438b2cd6e6f0b5f2de321e5be6f0169b5a1"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/agentfront/enclave/security/advisories/GHSA-7qm7-455j-5p63"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-693"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T16:19:28.332909+00:00", "value": {"mitigation_remediation": ["Upgrade to enclave\u2011vm version 2.7.0 or later to eliminate the prototype chain escape path.", "Replace or remove any legacy enclave modules that remain in the deployment before upgrading.", "Run enclave\u2011vm in a dedicated low\u2011privilege process or container to limit potential host impact."], "summary": {"action": "Apply Patch", "impact": "Code Execution in Host Runtime"}, "threat_synthesis": {"affected_systems": "Agentfront Enclave (enclave-vm) versions earlier than 2.7.0 are affected, regardless of the Node.js major version. Any deployment that uses these older enclave components exposes the host runtime to unauthorized code execution.", "description_and_impact": "A flaw in the enclave-vm sandbox permits untrusted JavaScript to break out of the isolation boundary and execute arbitrary code within the Node.js host process. The vulnerability arises when host\u2011side errors are exposed to the sandbox, allowing prototype chain traversal to reach the host Function constructor. An attacker can trigger such an error, climb the prototype chain, and compile code that runs with the privileges of the host. This bypasses all security guarantees, letting an attacker read environment variables, access the filesystem, and initiate network communication. The weakness is related to improper error handling (CWE\u2011693) and code injection (CWE\u201194).", "risk_and_exploitability": "The severity is high, reflected by a CVSS score of 10. The EPSS score is below 1\u202f%, indicating that exploitation is expected to be rare, and the vulnerability is not currently listed in CISA\u2019s Known Exploited Vulnerabilities catalog. The attack vector requires that an adversary supply sandboxed JavaScript that intentionally causes a host error, which can be performed within any context that evaluates untrusted code using enclave-vm. Attackers with code execution capabilities inside the sandbox can leverage the prototype chain traversal to gain host\u2011level access."}}}}, "created": "2026-01-14T10:49:10.686970+00:00", "updated": "2026-04-18T16:30:05.076803+00:00", "vendors": ["agentfront", "agentfront$PRODUCT$enclave"]}