10
CVE-2026-27597
- EPSS 0.88%
- Veröffentlicht 25.02.2026 04:16:03
- Zuletzt bearbeitet 27.02.2026 18:27:17
- Quelle security-advisories@github.com
- CVE-Watchlists
- Unerledigt
@enclave-vm/core is vulnerable to Sandbox Escape
Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to version 2.11.1, it is possible to escape the security boundraries set by `@enclave-vm/core`, which can be used to achieve remote code execution (RCE). The issue has been fixed in version 2.11.1.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Agentfront ≫ Enclave SwPlatformnode.js Version < 2.11.1
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.88% | 0.543 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| security-advisories@github.com | 10 | 3.9 | 6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
|
CWE-94 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
https://github.com/agentfront/enclave/commit/09afbebe4cb6d0586c1145aa71ffabd2103932db
https://github.com/agentfront/enclave/security/advisories/GHSA-f229-3862-4942