Platform
nodejs
Component
enclave-vm
Fixed in
2.7.1
2.7.1
2.7.0
CVE-2026-22686 represents a critical sandbox escape vulnerability affecting enclave-vm versions prior to 2.7.0. This flaw allows untrusted, sandboxed JavaScript code to execute arbitrary commands within the host Node.js runtime environment. The vulnerability stems from an exposed host-side Error object retaining its prototype chain, enabling attackers to reach the host Function constructor and execute malicious code. A patch is available in version 2.7.0.
The impact of CVE-2026-22686 is severe. An attacker exploiting this vulnerability can completely bypass the intended sandboxing of enclave-vm, gaining unrestricted access to the host Node.js process. This allows them to execute arbitrary code with the privileges of the Node.js process, potentially leading to complete system compromise. The ability to reach the Function constructor is a significant escalation of privilege, akin to achieving Remote Code Execution (RCE). This vulnerability could be leveraged to steal sensitive data, install malware, or pivot to other systems on the network.
CVE-2026-22686 was publicly disclosed on January 14, 2026. Its critical CVSS score of 10 suggests a high probability of exploitation. While no public proof-of-concept (PoC) has been observed at the time of writing, the vulnerability's ease of exploitation and the potential for significant impact make it a high-priority concern. It is not currently listed on the CISA KEV catalog, but its severity warrants close monitoring.
Exploit Status
EPSS
0.21% (44% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2026-22686 is to immediately upgrade to enclave-vm version 2.7.0 or later. If upgrading is not immediately feasible, consider implementing strict input validation and sanitization within the sandboxed JavaScript environment to minimize the potential attack surface. While not a complete solution, restricting access to sensitive host resources can limit the damage an attacker could inflict. Monitor Node.js process activity for unusual behavior, especially the creation of unexpected functions or execution of unfamiliar code. There are no specific WAF rules or detection signatures readily available for this specific prototype chain traversal technique, making proactive monitoring and rapid patching crucial.
Actualice la biblioteca enclave-vm a la versión 2.7.0 o superior. Esto corrige la vulnerabilidad de escape del sandbox. Ejecute `npm install enclave-vm@latest` o `yarn add enclave-vm@latest` para actualizar.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-22686 is a critical vulnerability in enclave-vm (< 2.6.0) that allows sandboxed JavaScript to execute arbitrary code in the host Node.js runtime, bypassing the intended security boundaries.
Yes, if you are using enclave-vm versions prior to 2.7.0, you are affected by this vulnerability and should prioritize upgrading immediately.
The recommended fix is to upgrade to enclave-vm version 2.7.0 or later. This resolves the prototype chain traversal issue that enables the sandbox escape.
While no active exploitation has been publicly confirmed, the vulnerability's severity and ease of exploitation suggest a high likelihood of future attacks.
Refer to the official enclave-vm project repository and release notes for the advisory and detailed information regarding the vulnerability and patch: [https://github.com/enclave-vm/enclave-vm](https://github.com/enclave-vm/enclave-vm)
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.