Executive brief
enclave-vm is a JavaScript sandbox execution environment used to safely run untrusted code. This vulnerability allows attackers to escape the sandbox and access the underlying host system, potentially reading sensitive files and executing arbitrary commands. The flaw exploits a Node.js bug that leaks host object references when infinite recursion occurs, combined with weaknesses in the sandbox's AST sanitization and error object hardening.
Technical details
The vulnerability is a sandbox escape in enclave-vm (now @enclave-vm/core) caused by insufficient security layers: AST sanitization can be bypassed via dynamic property accesses, error object hardening does not account for Node.js vm module behavior, and function constructor access prevention can be bypassed using host object references. An attacker exploits a known Node.js bug where the vm module leaks host references during infinite recursion. By triggering infinite recursion, catching the error, and accessing the error's prototype chain via dynamic property access (e.g., e[["__proto__"]]), an attacker can obtain a reference to the host's Function constructor and execute arbitrary code with full system access. The vulnerability was fixed in @enclave-vm/core version 2.10.1; the legacy enclave-vm package has no patched version.
Affected products
- AgentFront @enclave-vm/core all versions prior to 2.10.1
- AgentFront enclave-vm 2.7.0 and earlier (legacy package, no patched version available)
Timeline
- 2026-02-05: disclosed: Advisory published on GitHub
- 2026-02-05: patched: @enclave-vm/core fixed in version 2.10.1