@enclave-vm/core is vulnerable to Sandbox Escape

Description

It is possible to escape the security boundraries set by @enclave-vm/core, which can be used to achieve remote code execution (RCE).

The issue has been fixed in version 2.11.1.

Recommendation

Update the @enclave-vm/core package to the latest compatible version. Followings are version details:

• Affected version(s): <= 2.10.1
• Patched version(s): 2.11.1

References

• GHSA-f229-3862-4942
• CVE-2026-27597
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• enclave-vm Vulnerable to Sandbox Escape via Host Error Prototype Chain - CVE-2026-22686
• Sandbox escape via infinite recursion and error objects (GHSA-x39w-8vm5-5m3p) - CVE-2026-25533
• Sandbox escape via infinite recursion and error objects - CVE-2026-25533
• Cube Core is vulnerable to Denial of Service (DoS) via crafted request - CVE-2026-25957

Tags:

npm

@enclave-vm/core