Description
It is possible to escape the security boundraries set by @enclave-vm/core, which can be used to achieve remote code execution (RCE).
The issue has been fixed in version 2.11.1.
Recommendation
Update the @enclave-vm/core package to the latest compatible version. Followings are version details:
- Affected version(s): <= 2.10.1
- Patched version(s): 2.11.1
References
Related Issues
- Sandbox escape via infinite recursion and error objects - @enclave-vm/core - CVE-2026-25533
- enclave-vm Vulnerable to Sandbox Escape via Host Error Prototype Chain - CVE-2026-22686
- Sandbox escape via infinite recursion and error objects - CVE-2026-25533
- OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment - CVE-2026-41900
You might also like:
- Tags:
- npm
- @enclave-vm/core
Anything's wrong? Let us know Last updated on February 25, 2026