Critical · published January 13, 2026
🔥 A sneaky sandbox escape in Enclave allows untrusted JavaScript to run amok in the host Node.js environment! Think of it like a magician whose trick goes horribly wrong, revealing the hidden backstage instead of keeping the illusion. When the wrong spell is cast (or an error occurs), the audience (sandboxed code) can sneak backstage and see everything — including the sensitive props (like process.env and filesystem). An attacker could exploit this vulnerability to execute any code they want within the host environment, bypassing all security measures. This means they could access sensitive data, manipulate files, or even take control of the server! It's absolutely devastating for any application relying on Enclave for security.
Think of it like a magician whose trick goes horribly wrong, revealing the hidden backstage instead of keeping the illusion. When the wrong spell is cast (or an error occurs), the audience (sandboxed code) can sneak backstage and see everything — including the sensitive props (like process.env and filesystem). This vulnerability in enclave-vm allows attackers to escape the intended sandbox by triggering an error, which exposes the host Error object. By climbing the prototype chain to access the host Function constructor, malicious code can be compiled and executed in the host context — completely undermining the core security promise of isolation.
An attacker could exploit this vulnerability to execute any code they want within the host environment, bypassing all security measures. This means they could access sensitive data, manipulate files, or even take control of the server! It's absolutely devastating for any application relying on Enclave for security. Upgrade Enclave to version 2.7.0 immediately to close this critical escape route. Regularly audit your usage of the sandbox to ensure no untrusted code can impact the host environment. Stay updated on security releases to maintain a secure system. You've got this! By taking immediate action, you can secure your application and keep those sneaky attackers at bay! 🛡️