Plateforme
nodejs
Composant
enclave-vm
Corrigé dans
2.7.1
2.7.1
2.7.0
CVE-2026-22686 represents a critical sandbox escape vulnerability affecting enclave-vm versions prior to 2.7.0. This flaw allows untrusted, sandboxed JavaScript code to execute arbitrary commands within the host Node.js runtime environment. The vulnerability stems from an exposed host-side Error object retaining its prototype chain, enabling attackers to reach the host Function constructor and execute malicious code. A patch is available in version 2.7.0.
The impact of CVE-2026-22686 is severe. An attacker exploiting this vulnerability can completely bypass the intended sandboxing of enclave-vm, gaining unrestricted access to the host Node.js process. This allows them to execute arbitrary code with the privileges of the Node.js process, potentially leading to complete system compromise. The ability to reach the Function constructor is a significant escalation of privilege, akin to achieving Remote Code Execution (RCE). This vulnerability could be leveraged to steal sensitive data, install malware, or pivot to other systems on the network.
CVE-2026-22686 was publicly disclosed on January 14, 2026. Its critical CVSS score of 10 suggests a high probability of exploitation. While no public proof-of-concept (PoC) has been observed at the time of writing, the vulnerability's ease of exploitation and the potential for significant impact make it a high-priority concern. It is not currently listed on the CISA KEV catalog, but its severity warrants close monitoring.
Applications and services relying on enclave-vm for sandboxing JavaScript code are at significant risk. This includes development environments, CI/CD pipelines, and any system where untrusted code is executed within a sandboxed environment using enclave-vm. Specifically, those using older versions of enclave-vm (< 2.6.0) are highly vulnerable.
• nodejs / server:
ps aux | grep enclave-vm | grep -i 'function constructor'• nodejs / server:
journalctl -u node -f | grep -i 'prototype chain'• nodejs / server:
find / -name 'enclave-vm' -type d -print0 | xargs -0 grep -i 'Function constructor'disclosure
Statut de l'Exploit
EPSS
0.21% (percentile 44%)
CISA SSVC
Vecteur CVSS
The primary mitigation for CVE-2026-22686 is to immediately upgrade to enclave-vm version 2.7.0 or later. If upgrading is not immediately feasible, consider implementing strict input validation and sanitization within the sandboxed JavaScript environment to minimize the potential attack surface. While not a complete solution, restricting access to sensitive host resources can limit the damage an attacker could inflict. Monitor Node.js process activity for unusual behavior, especially the creation of unexpected functions or execution of unfamiliar code. There are no specific WAF rules or detection signatures readily available for this specific prototype chain traversal technique, making proactive monitoring and rapid patching crucial.
Actualice la biblioteca enclave-vm a la versión 2.7.0 o superior. Esto corrige la vulnerabilidad de escape del sandbox. Ejecute `npm install enclave-vm@latest` o `yarn add enclave-vm@latest` para actualizar.
Analyses de vulnérabilités et alertes critiques directement dans votre boîte mail.
CVE-2026-22686 is a critical vulnerability in enclave-vm (< 2.6.0) that allows sandboxed JavaScript to execute arbitrary code in the host Node.js runtime, bypassing the intended security boundaries.
Yes, if you are using enclave-vm versions prior to 2.7.0, you are affected by this vulnerability and should prioritize upgrading immediately.
The recommended fix is to upgrade to enclave-vm version 2.7.0 or later. This resolves the prototype chain traversal issue that enables the sandbox escape.
While no active exploitation has been publicly confirmed, the vulnerability's severity and ease of exploitation suggest a high likelihood of future attacks.
Refer to the official enclave-vm project repository and release notes for the advisory and detailed information regarding the vulnerability and patch: [https://github.com/enclave-vm/enclave-vm](https://github.com/enclave-vm/enclave-vm)
Téléverse ton fichier de dépendances et découvre instantanément si cette CVE et d'autres te touchent.