JavaScript Sandbox Vulnerability in Enclave by Agentfront

CVE-2026-25533

What is CVE-2026-25533?

Prior to version 2.10.1, Enclave, a secure JavaScript sandbox by Agentfront, exhibited several security weaknesses. These weaknesses included the ability to bypass Abstract Syntax Tree (AST) sanitization through dynamic property accesses. Additionally, the hardening of error object handling failed to address specific functionalities of the vm module, allowing for unauthorized access. Furthermore, restrictions on the function constructor were ineffectively applied, as they could be circumvented via host object references. Version 2.10.1 addresses these critical security concerns with improved protections.

References