CVE-2026-25533: Enclave JavaScript Sandbox RCE Vulnerability

CVE-2026-25533 Overview

CVE-2026-25533 is a sandbox escape vulnerability in Enclave, a secure JavaScript sandbox designed for safe AI agent code execution. Prior to version 2.10.1, multiple security layers in enclave-vm can be bypassed, allowing attackers to escape the sandboxed environment. The vulnerability stems from insufficient AST sanitization that can be circumvented through dynamic property accesses, inadequate hardening of error objects that fails to account for peculiar behavior of the vm module, and function constructor access prevention that can be side-stepped by leveraging host object references.

Critical Impact

Attackers can escape the JavaScript sandbox environment, potentially executing arbitrary code outside the intended security boundary and compromising the host system running AI agent workloads.

Affected Products

• Enclave versions prior to 2.10.1
• enclave-vm JavaScript sandbox module
• AI agent code execution environments using vulnerable Enclave versions

Discovery Timeline

• February 6, 2026 - CVE-2026-25533 published to NVD
• February 9, 2026 - Last updated in NVD database

Technical Details for CVE-2026-25533

Vulnerability Analysis

This vulnerability represents a critical flaw in the sandbox isolation mechanisms of Enclave's JavaScript execution environment. The security architecture relies on multiple defensive layers including AST (Abstract Syntax Tree) sanitization, error object hardening, and function constructor access prevention. However, researchers identified that these protections can be systematically bypassed through several attack vectors.

The AST sanitization mechanism is designed to prevent dangerous code patterns before execution. However, the vulnerability allows bypassing this protection through dynamic property accesses. For example, instead of directly accessing constructor, an attacker can use computed property access with coercion functions like String(['constructor']) which coerces an array to the string 'constructor', effectively evading static analysis checks.

The error object hardening was implemented to prevent information leakage and prototype pollution through exception handling. However, the vm module exhibits peculiar behavior that was not adequately addressed, allowing attackers to leverage error objects to gain references to host objects outside the sandbox boundary.

Root Cause

The root cause is classified under CWE-835 (Loop with Unreachable Exit Condition), combined with insufficient input validation on computed property access patterns. The AST rules failed to detect computed access via function calls that could produce dangerous strings through type coercion, such as obj[String(['constructor'])] or obj[['proto'].toString()]. This oversight allows attackers to construct property access chains that bypass static security checks while achieving the same dangerous operations at runtime.

Attack Vector

The attack requires local access and involves crafting JavaScript code that exploits the gaps between static analysis and runtime behavior. An attacker can leverage JavaScript's dynamic type coercion to construct property access patterns that:

1. Pass AST sanitization by avoiding literal dangerous property names
2. Coerce arrays or other values into dangerous strings at runtime
3. Access the function constructor through host object references
4. Escape the sandbox to execute arbitrary code in the host context

            });
          }
        }

        // Detect computed access via function calls that could produce dangerous strings
        // e.g., obj[String(['constructor'])] or obj[['proto'].toString()]
        // CVE-2023-29017 style bypass: String(['constructor']) coerces array to 'constructor'
        if (node.computed && node.property.type === 'CallExpression') {
          if (this.isSuspiciousCoercionCall(node.property)) {
            context.report({
              code: 'CONSTRUCTOR_ACCESS',
              message:
                'Computed property access via coercion function is not allowed (potential sandbox escape vector)',
              location: this.getLocation(node),
            });
          }
        }
      },

      // Detect suspicious variable assignments that build "constructor"

Source: GitHub Commit Update

Detection Methods for CVE-2026-25533

Indicators of Compromise

• Unexpected JavaScript execution patterns involving computed property access with coercion functions such as String(), toString(), or array-to-string conversions
• Attempts to access constructor, __proto__, or prototype through indirect means in sandboxed code
• Abnormal process spawning or system calls originating from AI agent execution contexts
• Error objects being manipulated or accessed in unusual patterns within sandbox boundaries

Detection Strategies

• Implement runtime monitoring for computed property access patterns that involve type coercion functions targeting sensitive properties
• Deploy static analysis tools to detect indirect constructor access attempts using patterns similar to obj[String(['constructor'])]
• Monitor for vm module error handling anomalies that could indicate exploitation attempts
• Enable detailed logging of all sandboxed code execution with emphasis on dynamic property accesses

Monitoring Recommendations

• Configure application logging to capture all dynamic property access operations within sandboxed environments
• Implement behavioral analysis to detect code patterns that bypass AST sanitization
• Set up alerts for any escape attempts from the enclave-vm sandbox environment
• Review AI agent code submissions for suspicious coercion-based property access patterns

How to Mitigate CVE-2026-25533

Immediate Actions Required

• Upgrade Enclave to version 2.10.1 or later immediately across all deployments
• Audit any AI agent code that has executed in vulnerable Enclave environments for potential compromise
• Implement additional runtime monitoring for sandbox escape attempts until patching is complete
• Review and restrict the permissions of processes running Enclave sandboxed code

Patch Information

The vulnerability is fixed in Enclave version 2.10.1. The patch implements enhanced detection for computed property access via coercion functions, specifically targeting patterns like obj[String(['constructor'])] that were previously able to bypass AST sanitization. The fix adds a new isSuspiciousCoercionCall check in the AST rules to identify and block these sandbox escape vectors. For technical details, refer to the GitHub Security Advisory and the patch commit.

Workarounds

• If immediate patching is not possible, implement additional input validation layer that blocks computed property access with function calls before code reaches the Enclave sandbox
• Consider using allowlist-based code execution that restricts the JavaScript features available within the sandbox
• Isolate Enclave sandbox processes using OS-level containerization to limit the blast radius of potential escapes
• Temporarily disable untrusted AI agent code execution until the patch can be applied

# Update Enclave to patched version
npm update enclave@2.10.1

# Verify installed version
npm list enclave

# If using yarn
yarn upgrade enclave@2.10.1