A flaw in the enclave-vm sandbox permits untrusted JavaScript to break out of the isolation boundary and execute arbitrary code within the Node.js host process. The vulnerability arises when host‑side errors are exposed to the sandbox, allowing prototype chain traversal to reach the host Function constructor. An attacker can trigger such an error, climb the prototype chain, and compile code that runs with the privileges of the host. This bypasses all security guarantees, letting an attacker read environment variables, access the filesystem, and initiate network communication. The weakness is related to improper error handling (CWE‑693) and code injection (CWE‑94).

Agentfront Enclave (enclave-vm) versions earlier than 2.7.0 are affected, regardless of the Node.js major version. Any deployment that uses these older enclave components exposes the host runtime to unauthorized code execution.

The severity is high, reflected by a CVSS score of 10. The EPSS score is below 1 %, indicating that exploitation is expected to be rare, and the vulnerability is not currently listed in CISA’s Known Exploited Vulnerabilities catalog. The attack vector requires that an adversary supply sandboxed JavaScript that intentionally causes a host error, which can be performed within any context that evaluates untrusted code using enclave-vm. Attackers with code execution capabilities inside the sandbox can leverage the prototype chain traversal to gain host‑level access.