Enclave provides a secure JavaScript sandbox for AI agent code. Before version 2.11.1, a flaw in @enclave-vm/core allows an attacker to escape the security boundaries of the sandbox. This escape can be leveraged to execute arbitrary code in the host environment, leading to full compromise of confidentiality, integrity, and availability. The weakness stems from improper code evaluation, classified as CWE‑94.

The vulnerability affects the Enclave product supplied by agentfront, specifically any instance running a version earlier than 2.11.1 that relies on @enclave-vm/core. Enclave runs on Node.js, and the affected package is listed under agentfront:enclave.

The flaw carries a CVSS score of 10, indicating Exponentially Critical severity. The EPSS score is less than 1%, suggesting a very low current exploitation probability, and it is not listed in the CISA KEV catalog. Nonetheless, the risk is high due to the capability for remote code execution that could be achieved by submitting crafted code to the sandbox, implying a likely remote or network-based attack path with no user interaction required.