Executive brief
enclave-vm is a JavaScript sandbox library used to safely execute untrusted code in applications like FrontMCP's CodeCall plugin. A critical vulnerability allows sandboxed code to escape the sandbox by traversing the prototype chain of error objects exposed by the host, gaining access to the host's Function constructor and enabling arbitrary code execution with full access to the host's environment (process, filesystem, network). This completely breaks the sandbox's core security guarantee.
Technical details
This is a prototype chain pollution and sandbox escape vulnerability (CWE-94: improper control of generation of code). When a tool invocation fails within enclave-vm, a host-side Error object is returned to sandboxed code while retaining its host realm prototype chain. An attacker can traverse Error.prototype → Error constructor → Function constructor to reach the host's native Function constructor. With the Function constructor, arbitrary JavaScript code can be compiled and executed in the host context, bypassing the sandbox entirely and gaining access to sensitive resources including process.env, filesystem APIs, and network calls. The vulnerability affects all versions prior to 2.7.0; a patch was released on January 9, 2026. No user interaction is required; network-reachable sandboxed code can trigger the escape.
Affected products
- agentfront enclave-vm < 2.7.0
Timeline
- 2026-01-13: disclosed
- 2026-01-09: patched: enclave-vm 2.7.0 released