The flaw originates from multiple weaknesses in Enclave’s security mechanisms. AST sanitization can be bypassed with dynamic property access, the hardening of error objects does not cover special behavior in the vm module, and the Function constructor restriction is circumvented via host object references. These combined weaknesses enable an attacker to escape the sandbox and execute arbitrary code, compromising the host process’s confidentiality and integrity.

The vulnerability affects Agentfront Enclave versions prior to 2.10.1. Users of 2.9.x and earlier are vulnerable.

The CVSS score of 6.4 indicates medium severity. EPSS is below 1%, suggesting a low probability of exploitation at this time. The issue is not listed in CISA’s KEV catalog. Attack is likely to occur when a malicious or compromised agent is executed within the sandbox; the attacker requires control over the agent code to exploit the bypasses.