Description
It is possible to escape the security boundraries set by @enclave-vm/core, which can be used to achieve remote code execution (RCE).
The issue has been fixed in version 2.11.1.
Recommendation
Update the @enclave-vm/core package to the latest compatible version. Followings are version details:
- Affected version(s): <= 2.10.1
- Patched version(s): 2.11.1
References
Related Issues
- Sandbox escape via infinite recursion and error objects - @enclave-vm/core - CVE-2026-25533
- enclave-vm Vulnerable to Sandbox Escape via Host Error Prototype Chain - CVE-2026-22686
- Cube Core is vulnerable to privilege escalation via a specially crafted request - CVE-2026-25958
- NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node - CVE-2026-34156
You might also like:
- Tags:
- npm
- @enclave-vm/core
Anything's wrong? Let us know Last updated on July 06, 2026