Sandbox escape via infinite recursion and error objects (GHSA-x39w-8vm5-5m3p)

Description

Note: The npm package has moved to @enclave-vm/core (formerly enclave-vm).
All fixed versions and guidance refer to @enclave-vm/core.

Recommendation

Update the @enclave-vm/core package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.10.1
• Patched version(s): 2.10.1

References

• GHSA-x39w-8vm5-5m3p
• www.staicu.org
• CVE-2026-25533
• CWE-835
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Sandbox escape via infinite recursion and error objects - CVE-2026-25533
• enclave-vm Vulnerable to Sandbox Escape via Host Error Prototype Chain - CVE-2026-22686
• @enclave-vm/core is vulnerable to Sandbox Escape - CVE-2026-27597
• Astro has Full-Read SSRF in error rendering via Host: header injection - CVE-2026-25545

Tags:

npm

@enclave-vm/core