CVE-2026-27597: RCE in @enclave-vm/core Node.js Module

The core of this vulnerability lies in the ability to obtain the native Object constructor instead of the intended SafeObject wrapper. This circumvents the security sandbox implemented by @enclave-vm/core. By retrieving property descriptors via Object.getOwnPropertyDescriptors, an attacker can access properties that are normally restricted. The hostmemorytrack host object, when a memory limit is set (the default configuration), provides a further avenue for escaping the sandbox and achieving code execution. Successful exploitation could allow an attacker to compromise the entire Node.js process and potentially gain control of the underlying system.

1. Reserved2026-02-20
2. Published2026-02-25
3. EPSS updated2026-03-23

The primary mitigation for CVE-2026-27597 is to immediately upgrade the @enclave-vm/core module to version 2.11.1 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily disabling memory limits within the module's configuration, although this significantly reduces the security posture. While not a complete solution, implementing strict input validation and sanitization on any data passed to the module can help reduce the attack surface. Monitor system logs for unusual activity related to @enclave-vm/core and investigate any suspicious patterns.