Sandbox escape via infinite recursion and error objects - @enclave-vm/core - CVE-2026-25533 | SmartScanner

Description

Note: The npm package has moved to @enclave-vm/core (formerly enclave-vm).
All fixed versions and guidance refer to @enclave-vm/core.

Recommendation

Update the @enclave-vm/core package to the latest compatible version. Followings are version details:

Affected version(s): < 2.10.1
Patched version(s): 2.10.1

References

GHSA-x39w-8vm5-5m3p
www.staicu.org
CVE-2026-25533
CWE-835
CAPEC-310
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for Sandbox escape via infinite recursion and error objects - @enclave-vm/core and gives you actionable findings to investigate.

Start a free scan

Related Issues

Sandbox escape via infinite recursion and error objects - CVE-2026-25533
enclave-vm Vulnerable to Sandbox Escape via Host Error Prototype Chain - CVE-2026-22686
@enclave-vm/core is vulnerable to Sandbox Escape - CVE-2026-27597
Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override - CVE-2026-69254

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

See something that needs correcting? Let us knowUpdated February 07, 2026