CVE-2026-27597 @enclave-vm/core is vulnerable to Sandbox Escape
Attackers can escape the JavaScript sandbox to achieve remote code execution, affecting users of the Enclave library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-27597?
CVE-2026-27597 is a critical code injection vulnerability in agentfront enclave, published on 25 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to version 2.11.1, it is possible to escape the security boundraries set by `@enclave-vm/core`, which can be used to achieve remote code execution (RCE). The issue has been fixed in version 2.11.1.
Weakness: CWE-94
Which versions are affected by CVE-2026-27597?
2 open source packages ship an affected version, including @enclave-vm/core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@enclave-vm/core npm | All versions | 2.11.1 |
@enclave-vm/core npm | All versions | 2.11.1 |
Products include Agentfront Enclave.
How do I fix CVE-2026-27597?
Upgrade @enclave-vm/core to 2.11.1 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-27597 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27597 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in agentfront enclave
Sources
Also known as GHSA-f229-3862-4942.