CVE-2026-22686

Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to 2.7.0, there is a critical sandbox escape vulnerability in enclave-vm that allows untrusted, sandboxed JavaScript code to execute arbitrary code in the host Node.js runtime. When a tool invocation fails, enclave-vm exposes a host-side Error object to sandboxed code. This Error object retains its host realm prototype chain, which can be traversed to reach the host Function constructor. An attacker can intentionally trigger a host error, then climb the prototype chain. Using the host Function constructor, arbitrary JavaScript can be compiled and executed in the host context, fully bypassing the sandbox and granting access to sensitive resources such as process.env, filesystem, and network. This breaks enclave-vm’s core security guarantee of isolating untrusted code. This vulnerability is fixed in 2.7.0.

• CWE-94
• CWE-693

• https://github.com/agentfront/enclave/commit/ed8bc438b2cd6e6f0b5f2de321e5be6f0169b5a1Patch
• https://github.com/agentfront/enclave/security/advisories/GHSA-7qm7-455j-5p63Exploit, Mitigation, Vendor Advisory

Published

Jan 14, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-22679Weaver (Fanwei) E-cology 10.0 versions prior to 20260312 con…9.8
• CVE-2026-2268The Ninja Forms plugin for WordPress is vulnerable to Sensit…7.5
• CVE-2026-22680OpenViking versions prior to 0.3.3 contain a missing authori…6.9
• CVE-2026-22682OpenHarness prior to commit 166fcfe contains an improper acc…8.4
• CVE-2026-22683Windmill versions 1.56.0 through 1.614.0 contain a missing a…8.8
• CVE-2026-22685DevToys is a desktop app for developers. In versions from 2.…9.8
• CVE-2026-22687WeKnora is an LLM-powered framework designed for deep docume…9.8
• CVE-2026-22688WeKnora is an LLM-powered framework designed for deep docume…8.8
• CVE-2026-22689Mailpit is an email testing tool and API for developers. Pri…6.5
• CVE-2026-2269The Uncanny Automator – Easy Automation, Integration, Webhoo…7.2
• CVE-2026-22690pypdf is a free and open-source pure-python PDF library. Pri…5.3
• CVE-2026-22691pypdf is a free and open-source pure-python PDF library. Pri…5.3