CVE-2026-27597: Enclave JavaScript Sandbox RCE Vulnerability

CVE-2026-27597 Overview

CVE-2026-27597 is a critical sandbox escape vulnerability affecting Enclave, a secure JavaScript sandbox designed for safe AI agent code execution. Prior to version 2.11.1, it is possible to escape the security boundaries set by @enclave-vm/core, which can be exploited to achieve remote code execution (RCE). This vulnerability poses a significant risk to environments where untrusted JavaScript code is executed within the Enclave sandbox.

Critical Impact

Attackers can escape the Enclave JavaScript sandbox to execute arbitrary code on the host system, completely compromising the security isolation that the sandbox is designed to provide.

Affected Products

• Enclave (@enclave-vm/core) versions prior to 2.11.1
• Applications using Enclave for AI agent code execution
• Systems relying on Enclave sandbox isolation for untrusted JavaScript execution

Discovery Timeline

• February 25, 2026 - CVE-2026-27597 published to NVD
• February 25, 2026 - Last updated in NVD database

Technical Details for CVE-2026-27597

Vulnerability Analysis

This vulnerability is classified as CWE-94 (Improper Control of Generation of Code - Code Injection). The sandbox escape flaw allows attackers to bypass the security boundaries implemented by Enclave's core module, enabling execution of arbitrary code outside the intended isolated environment. In the context of AI agent code execution, this is particularly dangerous as AI agents often process untrusted or dynamically generated code that must be contained within sandbox boundaries.

The vulnerability exploits weaknesses in how the sandbox handles identifier detection, particularly in object coercion scenarios. This allows malicious JavaScript code to access global objects and execute privileged operations that should be restricted by the sandbox.

Root Cause

The root cause lies in insufficient validation of identifiers during object coercion operations. The sandbox's AST (Abstract Syntax Tree) validation rules failed to properly detect disallowed identifiers when accessed through computed property access patterns or coercion mechanisms. This gap in the identifier detection logic allowed attackers to construct payloads that bypass the disallowed identifier checks and the global access restrictions.

Attack Vector

The attack is network-accessible with no authentication required. An attacker can craft malicious JavaScript code that, when executed within the Enclave sandbox, exploits the identifier detection weakness to access restricted globals and escape the sandbox environment. The changed scope allows the attack to impact resources beyond the vulnerable component itself.

The exploit leverages object coercion scenarios where static computed keys were not being properly analyzed by the security rules, allowing attackers to obfuscate access to disallowed identifiers and global objects.

// Security patch showing the fix - added coercion-utils import for proper identifier detection
// Source: libs/ast/src/rules/disallowed-identifier.rule.ts

 import * as walk from 'acorn-walk';
 import { ValidationRule, ValidationContext, ValidationSeverity } from '../interfaces';
 import { RuleConfigurationError } from '../errors';
+import { tryGetStaticComputedKeys } from './coercion-utils';

 /**
  * Options for DisallowedIdentifierRule

Source: GitHub Commit Update

// Security patch showing the fix - added coercion-utils import for global access rule
// Source: libs/ast/src/rules/no-global-access.rule.ts

 import type { ValidationRule, ValidationContext } from '../interfaces';
 import { ValidationSeverity } from '../interfaces';
 import * as walk from 'acorn-walk';
+import { tryGetStaticComputedKeys } from './coercion-utils';

 /**
  * Configuration options for NoGlobalAccessRule

Source: GitHub Commit Update

Detection Methods for CVE-2026-27597

Indicators of Compromise

• Unexpected process spawning or system command execution from Node.js processes running Enclave
• Sandbox execution logs showing access to restricted global objects like process, require, or global
• Unusual outbound network connections originating from sandbox worker processes
• File system access attempts from processes that should be sandboxed

Detection Strategies

• Monitor AST validation logs for bypass attempts involving computed property access patterns
• Implement runtime detection for attempts to access process, global, or require objects from sandboxed code
• Deploy application-level logging to capture sandbox escape attempts and unusual code execution patterns
• Use security monitoring tools to detect post-exploitation activity such as reverse shells or data exfiltration

Monitoring Recommendations

• Enable verbose logging for Enclave sandbox validation failures and security rule violations
• Implement anomaly detection for sandbox worker processes exhibiting unexpected system call patterns
• Monitor package versions in production to ensure @enclave-vm/core version 2.11.1 or later is deployed
• Set up alerts for any sandbox execution that triggers global access rule violations

How to Mitigate CVE-2026-27597

Immediate Actions Required

• Upgrade @enclave-vm/core to version 2.11.1 or later immediately
• Audit all applications using Enclave to ensure they are running the patched version
• Review sandbox execution logs for any signs of exploitation attempts
• Consider temporarily disabling untrusted code execution features until the patch is applied

Patch Information

The vulnerability has been fixed in Enclave version 2.11.1. The patch introduces proper handling of static computed keys through the tryGetStaticComputedKeys utility function, which is now used by both the DisallowedIdentifierRule and NoGlobalAccessRule to detect malicious identifier access patterns during object coercion scenarios.

For detailed patch information, see the GitHub Security Advisory GHSA-f229 and the security commit.

Workarounds

• Restrict execution of untrusted JavaScript code until the patch can be applied
• Implement additional process-level isolation (containers, VMs) around Enclave sandbox instances
• Apply network egress filtering to limit potential damage from successful sandbox escapes
• Use OS-level sandboxing mechanisms as an additional layer of defense

# Upgrade @enclave-vm/core to the patched version
npm update @enclave-vm/core@2.11.1

# Verify the installed version
npm list @enclave-vm/core

# For yarn users
yarn upgrade @enclave-vm/core@2.11.1