10

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-22686

CVE-2026-22686: Sandbox Escape via Host Error Prototype Chain in enclave-vm

Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to 2.7.0, there is a critical sandbox escape vulnerability in enclave-vm that allows untrusted, sandboxed JavaScript code to execute arbitrary code in the host Node.js runtime. When a tool invocation fails, enclave-vm exposes a host-side Error object to sandboxed code. This Error object retains its host realm prototype chain, which can be traversed to reach the host Function constructor. An attacker can intentionally trigger a host error, then climb the prototype chain. Using the host Function constructor, arbitrary JavaScript can be compiled and executed in the host context, fully bypassing the sandbox and granting access to sensitive resources such as process.env, filesystem, and network. This breaks enclave-vm’s core security guarantee of isolating untrusted code. This vulnerability is fixed in 2.7.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-22686

CVE-2026-22686:

10

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
enclave-vm	npm	< 2.7.0	2.7.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability was a sandbox escape caused by a host-side Error object leaking into the sandboxed environment during a failed tool call. The analysis of the patch commit ed8bc438b2cd6e6f0b5f2de321e5be6f0169b5a1 reveals two key changes that address this.

First, the introduction of a new createHostToolBridge function in libs/enclave-vm/src/tool-bridge.ts. This function acts as a secure intermediary for tool calls. The vulnerable logic existed in the predecessor to this function. When a user-provided toolHandler throws an error, the catch block in createHostToolBridge now intercepts it. Instead of propagating the raw Error object, it converts the error into a safe, serializable JSON payload. This payload contains only the error message and name, not the object's prototype chain. This is the primary fix that prevents the host object from leaking.

Second, as a defense-in-depth measure, a new utility function createSafeError was added in libs/enclave-vm/src/safe-error.ts. This function is used to create Error objects with a completely severed prototype chain by using Object.setPrototypeOf(error, null). This function is now used in multiple places within the enclave-vm codebase (including in the logic that reconstructs errors from the tool bridge) to ensure that any error generated or handled by the VM system is 'safe' and cannot be used to climb the prototype chain to access host constructors like Function.

Therefore, the function that invokes the tool handler (createHostToolBridge in the patched code) and the function used to create safe errors (createSafeError) are the critical functions related to this vulnerability and its fix.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.