CVE-2026-25533: 
JavaScript vulnerability analysis and mitigation

CVE-2026-25533 is a sandbox escape vulnerability in Enclave (agentfront/enclave), a secure JavaScript sandbox designed for safe AI agent code execution. The flaw exists in versions 2.7.0 through 2.10.0 of the enclave-vm / @enclave-vm/core npm packages, and was disclosed on February 5, 2026 by researcher frontegg-david. It carries a CVSS v3.1 score of 8.8 (High) and a CVSS v4.0 score of 6.4 (Medium), with the discrepancy reflecting that the direct system impact is scoped to the subsequent (host) system rather than the sandboxed context (Github Advisory, Security Advisory).

The vulnerability stems from three compounding weaknesses in the enclave-vm sandbox (CWE-835 — Loop with Unreachable Exit Condition): (1) AST sanitization can be bypassed using dynamic property accesses (e.g., bracket notation with computed strings), (2) error object hardening fails to account for a known Node.js vm module behavior where infinite recursion causes the vm module to leak host object references into the sandboxed context, and (3) function constructor access prevention can be circumvented by leveraging those leaked host references. The root cause is a documented Node.js bug (described in the SandDriller USENIX Security 2023 paper) where a stack overflow exception inside a vm context exposes the host's prototype chain. A public PoC is included in the advisory, demonstrating exploitation on Node.js v24.12.0 and enclave-vm 2.7.0 (Security Advisory, Github Advisory).

Successful exploitation allows an attacker to fully escape the JavaScript sandbox and execute arbitrary code on the host system, bypassing all three layers of the sandbox's security mechanisms. The impact on the subsequent (host) system is rated High for confidentiality, integrity, and availability, enabling access to sensitive files (e.g., /etc/passwd), arbitrary command execution, and potential full system compromise. This is particularly severe in environments such as FrontMCP, AgentFront, and other Frontegg products that rely on Enclave to safely execute untrusted or AI agent-generated code (Security Advisory).

A working proof-of-concept exploit is publicly available in the GitHub security advisory, tested against Node.js v24.12.0 and enclave-vm 2.7.0. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.014% (1st percentile), indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory, Security Advisory).

1. Identify a target: Locate an application using enclave-vm or @enclave-vm/core versions 2.7.0–2.10.0 that executes attacker-controlled or AI agent-generated JavaScript code within an Enclave sandbox.
2. Trigger infinite recursion: Submit code to the Enclave runtime that calls a function recursively until a stack overflow occurs, causing Node.js's vm module to leak host object references into the sandboxed error object.
3. Capture the leaked host reference: In the catch block of the recursive function, traverse the prototype chain of the caught error object using dynamic bracket notation (e.g., e["__proto__"]["__proto__"]["__proto__"]) to obtain a reference to the host's root prototype — bypassing AST sanitization via computed property access.
4. Access the Function constructor: Assign the host Function constructor to a property on the captured prototype (e.g., rootProt["foo"] = rootProt["toString"]["constructor"]), circumventing the sandbox's function constructor access prevention.
5. Execute arbitrary host code: Invoke the obtained Function constructor with a malicious payload string to run arbitrary Node.js code outside the sandbox, such as spawning a child process to read /etc/passwd via process.binding('spawn_sync').spawn(options) (Security Advisory, Github Advisory).

• Process: Unexpected child processes (e.g., cat, sh, bash, curl, wget) spawned by the Node.js process running the Enclave sandbox; use of process.binding('spawn_sync') in executed code.
• Logs: Application logs showing stack overflow / maximum call stack size exceeded errors originating from within sandboxed code execution; repeated or unusual error stack traces involving vm module internals.
• File System: Unexpected file reads of sensitive files (e.g., /etc/passwd, /etc/shadow, SSH keys) by the Node.js process; new files or scripts written to disk by the sandbox host process.
• Network: Unexpected outbound network connections from the Node.js process following sandbox execution of untrusted code, potentially indicating data exfiltration or reverse shell establishment.

Upgrade to @enclave-vm/core version 2.10.1 or later, which implements security hardening against stack overflow escape attacks, including improved AST sanitization for computed property accesses and coercion-based bypass patterns. The legacy enclave-vm npm package (versions ≤ 2.7.0) has no patched release and users must migrate to @enclave-vm/core. As an interim measure for systems that cannot be immediately patched, restrict local access to systems running affected versions, avoid executing untrusted or AI agent code through the vulnerable sandbox, and isolate affected systems from critical infrastructure (Github Advisory, Patch Commit).

The vulnerability was credited to researcher cristianstaicu, whose prior work on Node.js vm module sandbox escapes (the SandDriller paper, USENIX Security 2023) directly informed the attack technique. The advisory was published by frontegg-david of the Frontegg/AgentFront team, who also developed the fix. No significant broader media coverage or social media discussion has been identified beyond the GitHub advisory and standard vulnerability database aggregators (Security Advisory).