Sandbox escape via infinite recursion and error objects - @enclave-vm/core

Description

Note: The npm package has moved to @enclave-vm/core (formerly enclave-vm).
All fixed versions and guidance refer to @enclave-vm/core.

Recommendation

Update the @enclave-vm/core package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.10.1
• Patched version(s): 2.10.1

References

• GHSA-x39w-8vm5-5m3p
• www.staicu.org
• CVE-2026-25533
• CWE-835
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Sandbox escape via infinite recursion and error objects - CVE-2026-25533
• enclave-vm Vulnerable to Sandbox Escape via Host Error Prototype Chain - CVE-2026-22686
• @enclave-vm/core is vulnerable to Sandbox Escape - CVE-2026-27597
• OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment - CVE-2026-41900

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@enclave-vm/core