CVE-2026-22686: 
JavaScript vulnerability analysis and mitigation

CVE-2026-22686 is a critical sandbox escape vulnerability in enclave-vm, a secure JavaScript sandbox designed for safe AI agent code execution. The flaw allows untrusted, sandboxed JavaScript code to execute arbitrary code in the host Node.js runtime by traversing a host-side Error object's prototype chain to reach the host Function constructor. It affects all versions of the enclave-vm npm package prior to 2.7.0. The fix was released on January 9, 2026, and the advisory was published on January 13, 2026. It carries a CVSS v3.1 base score of 10.0 (Critical) (GitHub Advisory, Enclave Security Advisory).

The root cause is classified under CWE-94 (Improper Control of Generation of Code / Code Injection) and CWE-693 (Protection Mechanism Failure). When a tool invocation fails inside the sandbox, enclave-vm incorrectly exposes a host-realm Error object directly to sandboxed code without sanitizing its prototype chain. An attacker can traverse this chain — Error instance → Error.prototype → Error constructor → Function constructor — to obtain a reference to the host Function constructor, which can then be used to compile and execute arbitrary JavaScript in the host Node.js context. No privileges, user interaction, or special preconditions are required beyond the ability to submit code for sandboxed execution. A public proof-of-concept using obfuscated String.fromCharCode calls to bypass AST-level detection is included in the official advisory (Enclave Security Advisory, GitHub Advisory).

Successful exploitation fully breaks the sandbox isolation guarantee of enclave-vm, granting an attacker arbitrary code execution in the host Node.js runtime. This provides complete access to sensitive host resources including environment variables (process.env), the filesystem, and network interfaces, enabling credential theft, data exfiltration, lateral movement, and full host compromise. The scope change (S:C in CVSS) reflects that the impact extends beyond the sandboxed component to the broader host system. Downstream ecosystems such as FrontMCP's CodeCall plugin, which relies on enclave-vm as its defense-in-depth sandbox layer, are also directly affected (GitHub Advisory, Enclave Security Advisory).

Multiple public proof-of-concept exploits are available, including one published in the official GitHub Security Advisory and at least two additional PoC repositories on GitHub (https://github.com/amusedx/CVE-2026-22686 and https://github.com/0x30c4/enclave-vm-CVE-2026-22686). The vulnerability requires no authentication, no privileges, and no user interaction, making it trivially exploitable by any party able to submit code to a vulnerable enclave-vm instance. The EPSS score is approximately 0.274% (51st percentile), and there is no confirmed evidence of in-the-wild exploitation at this time. The vulnerability has not been added to the CISA KEV catalog as of the time of this report. Qualys has added detection for this CVE (detection ID 5006993) (GitHub Advisory, Feedly).

1. Identify a target: Locate a service or application running enclave-vm versions prior to 2.7.0 that accepts and executes user-supplied or AI-generated JavaScript code (e.g., via FrontMCP CodeCall or a custom integration).
2. Craft the payload: Prepare a sandboxed JavaScript payload that uses obfuscated string construction (e.g., String.fromCharCode) to avoid AST-level detection of sensitive keywords like constructor and __proto__.
3. Trigger a host-side error: Within the sandboxed code, call a non-existent tool using await callTool('THIS_TOOL_DOES_NOT_EXIST_XYZ', {}) inside a try/catch block. This causes enclave-vm to expose a host-realm Error object to the sandbox.
4. Traverse the prototype chain: Use Object.prototype.__lookupGetter__ or equivalent native prototype accessors to walk the caught error's prototype chain: hostError → Error.prototype → Error constructor → Function constructor.
5. Obtain the host Function constructor: Extract the host Function constructor from the traversed chain, which exists in the host realm and is not subject to sandbox restrictions.
6. Execute arbitrary host code: Invoke the host Function constructor with a payload string (e.g., 'return process.env') to compile and execute arbitrary JavaScript in the host Node.js context, gaining full access to environment variables, filesystem, and network (Enclave Security Advisory, GitHub Advisory).

• Logs: Unexpected tool invocation errors for non-existent tool names (e.g., THIS_TOOL_DOES_NOT_EXIST_XYZ) in application or sandbox execution logs, which may indicate prototype chain traversal attempts.
• Process Behavior: Unusual child processes or system calls originating from the Node.js process hosting enclave-vm, such as file reads, network connections, or environment variable access not initiated by legitimate application logic.
• Network: Unexpected outbound connections from the Node.js host process to external IPs, particularly following sandbox execution events.
• File System: Unexpected file reads or writes in sensitive directories (e.g., /etc/, home directories, application config paths) by the Node.js process.
• Application Behavior: Sandbox execution returning unexpected data such as environment variable contents, file listings, or other host-level information not normally accessible to sandboxed code (Enclave Security Advisory).

The primary remediation is to upgrade enclave-vm to version 2.7.0 or later immediately, which implements safe error handling that prevents host-realm Error objects from being exposed to sandboxed code. The patch (commit ed8bc43) introduces safe error reconstruction, prototype chain stripping/freezing, and a secure tool bridge with configurable payload limits. As defense-in-depth measures, operators should: re-create all Error objects crossing the sandbox boundary inside the sandbox realm; strip or freeze prototype chains of any host objects passed to sandboxed code; and prevent sandboxed code from accessing host Function constructors. Users of FrontMCP CodeCall should treat this as an urgent upgrade. Network segmentation to limit blast radius is also recommended while patching is underway (Enclave Security Advisory, Patch Commit).

The vulnerability received coverage from The Hacker Wire and was discussed on Mastodon and Bluesky shortly after disclosure. A Reddit thread in the r/mcp community urged users of FrontMCP CodeCall to upgrade immediately. INCIBE-CERT (Spain's national cybersecurity agency) published an early warning advisory. The CISA vulnerability bulletin for the week of January 12, 2026 also referenced this CVE. Community reaction emphasized the urgency of the upgrade given the CVSS 10.0 score and the availability of public PoC exploits (The Hacker Wire, Reddit, CISA Bulletin).