Sandbox escape via infinite recursion and error objects

Description

Note: The npm package has moved to @enclave-vm/core (formerly enclave-vm).
All fixed versions and guidance refer to @enclave-vm/core.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 2.7.0

References

• GHSA-x39w-8vm5-5m3p
• www.staicu.org
• CVE-2026-25533
• CWE-835
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Sandbox escape via infinite recursion and error objects (GHSA-x39w-8vm5-5m3p) - CVE-2026-25533
• enclave-vm Vulnerable to Sandbox Escape via Host Error Prototype Chain - CVE-2026-22686
• Seroval affected by Denial of Service via Deeply Nested Objects - CVE-2026-24006
• @enclave-vm/core is vulnerable to Sandbox Escape - CVE-2026-27597

Tags:

npm

enclave-vm