CVE-2026-27597
Published: 25 February 2026
Description
Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to version 2.11.1, it is possible to escape the security boundraries set by `@enclave-vm/core`, which can be used to achieve remote code execution (RCE). The issue…
more
has been fixed in version 2.11.1.
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the sandbox escape vulnerability by requiring timely remediation through patching to Enclave version 2.11.1 or later.
Enforces software-based separation and policy enforcement mechanisms essential for JavaScript sandboxes like Enclave to prevent boundary escapes leading to RCE.
Implements a reference monitor to mediate all subject-object accesses within the sandbox, countering improper control of code generation and escape vulnerabilities.
Security SummaryAI
CVE-2026-27597 affects Enclave, a secure JavaScript sandbox designed for safe AI agent code execution. Prior to version 2.11.1, the vulnerability allows attackers to escape the security boundaries enforced by the `@enclave-vm/core` component, enabling remote code execution (RCE). This flaw is classified under CWE-94 (Improper Control of Generation of Code) and carries a maximum CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), indicating critical severity due to its network accessibility, low attack complexity, and lack of prerequisites.
The vulnerability can be exploited by any unauthenticated attacker over the network with no user interaction required. Successful exploitation grants scope-changing privileges, allowing full compromise of confidentiality, integrity, and availability on the host system through arbitrary RCE, potentially leading to complete system takeover.
The security advisory (GHSA-f229-3862-4942) and associated commit (09afbebe4cb6d0586c1145aa71ffabd2103932db) confirm the issue was fixed in Enclave version 2.11.1. Security practitioners should upgrade to this version or later to mitigate the vulnerability.
Details
- CWE(s)
Affected Products
AI Security AnalysisAI
- AI Category
- Other AI Platforms
- Risk Domain
- N/A
- OWASP Top 10 for LLMs 2025
- None mapped
- MITRE ATLAS Techniques
- None mapped
- Classification Reason
- Matched keywords: ai
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables remote code execution via exploitation of a public-facing JavaScript sandbox component (AV:N/AC:L/PR:N), directly mapping to T1190: Exploit Public-Facing Application.