6.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25533

CVE-2026-25533: Enclave has a sandbox escape via infinite recursion and error objects

Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to 2.10.1, the existing layers of security in enclave-vm are insufficient: The AST sanitization can be bypassed with dynamic property accesses, the hardening of the error objects does not cover the peculiar behavior or the vm module and the function constructor access prevention can be side-stepped by leveraging host object references. This vulnerability is fixed in 2.10.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25533

CVE-2026-25533:

6.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
enclave-vm	npm	<= 2.7.0
@enclave-vm/core	npm	< 2.10.1	2.10.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a sandbox escape in enclave-vm triggered by executing specially crafted JavaScript code via the Enclave.run method. The root cause is a combination of two weaknesses:

Insufficient AST Sanitization: The static analysis of the code, performed by rules like ResourceExhaustionRule, could be bypassed. An attacker could use dynamic property access with string coercion (e.g., error[String(['__proto__'])]) to hide access to sensitive properties like __proto__ and constructor. The ResourceExhaustionRule.MemberExpression function, which is responsible for checking property access, did not account for these dynamic patterns, allowing the malicious payload to pass the sanitization step.
Leaked Host References from Error Objects: Once the malicious code bypassed validation and was executed, it would trigger an infinite recursion, causing a stack overflow and generating a RangeError. Due to a weakness in how the underlying Node.js vm module handles such errors, the thrown RangeError object retained a prototype chain that led back to the host environment's Object.prototype. The sandbox environment was not sufficiently hardened to sever this chain.

The exploit involves catching this error, traversing its prototype chain (e.g., e.__proto__.__proto__.__proto__) to get a reference to the host's Object.prototype, and then accessing the Function constructor to execute arbitrary code with the privileges of the host process.

The patch addresses this by enhancing the AST validation in ResourceExhaustionRule to detect and block these dynamic property access patterns, and by adding hardening measures in the VM bootstrap script (parent-vm-bootstrap.ts) to shadow the __proto__ property on all Error prototypes, effectively cutting off the prototype chain traversal attack.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.