CVE-2026-22686
CRITICALenclave-vm < 2.7.0 - Sandbox Escape via Host Error Prototype Chain Traversal
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2026-22686. PoCs published by XiaomingX, moltengama, amusedx.
AI-analyzed exploit summary The repository contains a functional PoC for CVE-2026-22686, demonstrating a sandbox escape and RCE in Node.js ESM environments by leveraging `process.getBuiltinModule` to bypass module loading restrictions. The README provides detailed technical analysis of the vulnerability and alternative exploitation vectors.
Description
Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to 2.7.0, there is a critical sandbox escape vulnerability in enclave-vm that allows untrusted, sandboxed JavaScript code to execute arbitrary code in the host Node.js runtime. When a tool invocation fails, enclave-vm exposes a host-side Error object to sandboxed code. This Error object retains its host realm prototype chain, which can be traversed to reach the host Function constructor. An attacker can intentionally trigger a host error, then climb the prototype chain. Using the host Function constructor, arbitrary JavaScript can be compiled and executed in the host context, fully bypassing the sandbox and granting access to sensitive resources such as process.env, filesystem, and network. This breaks enclave-vm’s core security guarantee of isolating untrusted code. This vulnerability is fixed in 2.7.0.
Exploits (3)
The repository contains a functional PoC for CVE-2026-22686, demonstrating a sandbox escape and RCE in Node.js ESM environments by leveraging `process.getBuiltinModule` to bypass module loading restrictions. The README provides detailed technical analysis of the vulnerability and alternative exploitation vectors.
The repository contains a functional exploit PoC for CVE-2026-22686, leveraging Node.js's `process.getBuiltinModule` API to achieve remote code execution in ESM environments. The payload bypasses sandbox restrictions by enumerating host context keys and executing arbitrary commands via `child_process`.
This PoC demonstrates a sandbox escape via prototype chain traversal and host error manipulation to achieve remote code execution. It exploits a vulnerability in a JavaScript sandbox environment by leveraging host-side errors and prototype manipulation.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H