enclave-vm Vulnerable to Sandbox Escape via Host Error Prototype Chain

Description

A critical sandbox escape vulnerability exists in enclave-vm (affected: < 2.6.0, patched: 2.7.0) that can allow untrusted, sandboxed JavaScript to execute arbitrary code in the host Node.js runtime.

Recommendation

Update the enclave-vm package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.7.0
• Patched version(s): 2.7.0

References

• GHSA-7qm7-455j-5p63
• CVE-2026-22686
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Sandbox escape via infinite recursion and error objects - CVE-2026-25533
• Sandbox escape via infinite recursion and error objects (GHSA-x39w-8vm5-5m3p) - CVE-2026-25533
• @enclave-vm/core is vulnerable to Sandbox Escape - CVE-2026-27597
• Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution - CVE-2026-30939

Tags:

npm

enclave-vm