CVE-2026-27597: agentfront @enclave-vm/core sandbox escape leading to RCE

Executive brief

@enclave-vm/core is a library used to create secure isolated environments (sandboxes) for executing untrusted code. A vulnerability was discovered that allows code running inside this sandbox to break out and execute commands directly on the underlying host server. This could lead to a full system takeover, unauthorized data access, or service disruption.

Technical details

A sandbox escape vulnerability exists in @enclave-vm/core due to improper isolation of intrinsic objects and host references. Attackers can obtain the native 'Object' constructor instead of the intended 'SafeObject' wrapper, allowing them to retrieve property descriptors via 'Object.getOwnPropertyDescriptors' and access restricted properties. Depending on the configuration, an attacker can leverage the '__host_memory_track__' host object or Node's 'nodejs.util.inspect.custom' symbol to access the host function constructor and execute arbitrary shell commands. The issue is fixed in version 2.11.1 by strengthening intrinsic object isolation and hardening host callback exposure paths.

Affected products

• agentfront @enclave-vm/core <= 2.10.1

Timeline

• 2026-02-22: patched: Initial fix in v2.11.0; full fix in v2.11.1
• 2026-02-25: advisory
• 2026-02-25: disclosed

References

• https://api.github.com/users/c0rydoras
• https://github.com/c0rydoras
• https://api.github.com/users/c0rydoras/gists%7B/gist_id%7D
• https://api.github.com/users/c0rydoras/repos
• https://avatars.githubusercontent.com/u/110528300?v=4
• https://api.github.com/users/c0rydoras/events%7B/privacy%7D