enclave-vm Vulnerable to Sandbox Escape via Host Error Prototype Chain

Description

A critical sandbox escape vulnerability exists in enclave-vm (affected: < 2.6.0, patched: 2.7.0) that can allow untrusted, sandboxed JavaScript to execute arbitrary code in the host Node.js runtime.

Recommendation

Update the enclave-vm package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.7.0
• Patched version(s): 2.7.0

References

• GHSA-7qm7-455j-5p63
• CVE-2026-22686
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• React Router has CSRF issue in Action/Server Action Request Processing - CVE-2026-22030
• Predictable results in nanoid generation when given non-integer values - CVE-2024-55565
• HackMD MCP Server has Server-Side Request Forgery (SSRF) vulnerability - CVE-2025-59155
• OpenList (frontend) allows XSS Attacks in the built-in Markdown Viewer - CVE-2025-50183

Tags:

npm

enclave-vm