CVE-2026-25533

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25533", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-02T19:59:47.373Z", "datePublished": "2026-02-06T21:16:57.162Z", "dateUpdated": "2026-02-09T15:27:09.399Z"}, "containers": {"cna": {"title": "Enclave has a sandbox escape via infinite recursion and error objects", "problemTypes": [{"descriptions": [{"cweId": "CWE-835", "lang": "en", "description": "CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H", "version": "4.0"}}], "references": [{"name": "https://github.com/agentfront/enclave/security/advisories/GHSA-x39w-8vm5-5m3p", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/agentfront/enclave/security/advisories/GHSA-x39w-8vm5-5m3p"}, {"name": "https://github.com/agentfront/enclave/commit/2fcf5da81e7e2578ede6f94cae4f379165426dca", "tags": ["x_refsource_MISC"], "url": "https://github.com/agentfront/enclave/commit/2fcf5da81e7e2578ede6f94cae4f379165426dca"}, {"name": "https://www.staicu.org/publications/usenixSec2023-SandDriller.pdf", "tags": ["x_refsource_MISC"], "url": "https://www.staicu.org/publications/usenixSec2023-SandDriller.pdf"}], "affected": [{"vendor": "agentfront", "product": "enclave", "versions": [{"version": "< 2.10.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-06T21:16:57.162Z"}, "descriptions": [{"lang": "en", "value": "Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to 2.10.1, the existing layers of security in enclave-vm are insufficient: The AST sanitization can be bypassed with dynamic property accesses, the hardening of the error objects does not cover the peculiar behavior or the vm module and the function constructor access prevention can be side-stepped by leveraging host object references. This vulnerability is fixed in 2.10.1."}], "source": {"advisory": "GHSA-x39w-8vm5-5m3p", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-09T15:19:19.464827Z", "id": "CVE-2026-25533", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-09T15:27:09.399Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25533", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-09T15:19:19.464827Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-09T15:19:20.309Z"}}], "cna": {"title": "Enclave has a sandbox escape via infinite recursion and error objects", "source": {"advisory": "GHSA-x39w-8vm5-5m3p", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "agentfront", "product": "enclave", "versions": [{"status": "affected", "version": "< 2.10.1"}]}], "references": [{"url": "https://github.com/agentfront/enclave/security/advisories/GHSA-x39w-8vm5-5m3p", "name": "https://github.com/agentfront/enclave/security/advisories/GHSA-x39w-8vm5-5m3p", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/agentfront/enclave/commit/2fcf5da81e7e2578ede6f94cae4f379165426dca", "name": "https://github.com/agentfront/enclave/commit/2fcf5da81e7e2578ede6f94cae4f379165426dca", "tags": ["x_refsource_MISC"]}, {"url": "https://www.staicu.org/publications/usenixSec2023-SandDriller.pdf", "name": "https://www.staicu.org/publications/usenixSec2023-SandDriller.pdf", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to 2.10.1, the existing layers of security in enclave-vm are insufficient: The AST sanitization can be bypassed with dynamic property accesses, the hardening of the error objects does not cover the peculiar behavior or the vm module and the function constructor access prevention can be side-stepped by leveraging host object references. This vulnerability is fixed in 2.10.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-835", "description": "CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-06T21:16:57.162Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25533", "state": "PUBLISHED", "dateUpdated": "2026-02-09T15:27:09.399Z", "dateReserved": "2026-02-02T19:59:47.373Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-06T21:16:57.162Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "enclave", "vendor": "agentfront", "versions": [{"status": "affected", "version": "< 2.10.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:agentfront:enclave:*:*:*:*:*:*:*:*", "matchCriteriaId": "B0AEA41C-F6D1-4981-A259-DFD61CBF362F", "versionEndExcluding": "2.10.1", "versionStartIncluding": "2.7.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to 2.10.1, the existing layers of security in enclave-vm are insufficient: The AST sanitization can be bypassed with dynamic property accesses, the hardening of the error objects does not cover the peculiar behavior or the vm module and the function constructor access prevention can be side-stepped by leveraging host object references. This vulnerability is fixed in 2.10.1."}, {"lang": "es", "value": "Enclave es un sandbox seguro de JavaScript dise\u00f1ado para la ejecuci\u00f3n segura de c\u00f3digo de agentes de IA. Antes de 2.10.1, las capas de seguridad existentes en enclave-vm son insuficientes: La sanitizaci\u00f3n AST puede ser eludida con accesos din\u00e1micos a propiedades, el endurecimiento de los objetos de error no cubre el comportamiento peculiar o del m\u00f3dulo vm y la prevenci\u00f3n de acceso al constructor de funciones puede ser eludida aprovechando referencias a objetos del host. Esta vulnerabilidad est\u00e1 corregida en 2.10.1."}], "id": "CVE-2026-25533", "lastModified": "2026-06-17T10:24:48.443", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25533", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-09T15:19:19.464827Z", "version": "2.0.3"}}]}, "published": "2026-02-06T22:16:11.450", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/agentfront/enclave/commit/2fcf5da81e7e2578ede6f94cae4f379165426dca"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/agentfront/enclave/security/advisories/GHSA-x39w-8vm5-5m3p"}, {"source": "security-advisories@github.com", "tags": ["Technical Description"], "url": "https://www.staicu.org/publications/usenixSec2023-SandDriller.pdf"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-835"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-17T22:23:15.262061+00:00", "value": {"mitigation_remediation": ["Upgrade Enclave to version 2.10.1 or later.", "If an upgrade is not currently possible, restrict agent code to static-only AST usage and avoid dynamic property accesses.", "Consider disabling the host environment\u2019s vm module or isolate it from the sandbox to prevent the Function constructor from being exploited."], "summary": {"action": "Immediate Patch", "impact": "Potential arbitrary code execution through sandbox escape"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Agentfront Enclave versions prior to 2.10.1. Users of 2.9.x and earlier are vulnerable.", "description_and_impact": "The flaw originates from multiple weaknesses in Enclave\u2019s security mechanisms. AST sanitization can be bypassed with dynamic property access, the hardening of error objects does not cover special behavior in the vm module, and the Function constructor restriction is circumvented via host object references. These combined weaknesses enable an attacker to escape the sandbox and execute arbitrary code, compromising the host process\u2019s confidentiality and integrity.", "risk_and_exploitability": "The CVSS score of 6.4 indicates medium severity. EPSS is below 1%, suggesting a low probability of exploitation at this time. The issue is not listed in CISA\u2019s KEV catalog. Attack is likely to occur when a malicious or compromised agent is executed within the sandbox; the attacker requires control over the agent code to exploit the bypasses."}}}}, "created": "2026-02-09T10:50:23.096295+00:00", "updated": "2026-04-17T22:30:29.592875+00:00", "vendors": ["agentfront", "agentfront$PRODUCT$enclave"]}