CVE-2026-25533 Details

A vulnerability in the Enclave JavaScript sandbox, specifically in version 2.7.0 prior to 2.10.1, allows for unauthorized access to host references, leading to potential sandbox escape. This issue arises from inadequate security measures, where dynamic property accesses can bypass Abstract Syntax Tree (AST) sanitization, and the error object hardening fails to address the unique behaviors of the vm module. Exploitation can be achieved by leveraging these weaknesses to traverse prototype chains and access privileged operations, such as Node.js' require function, which can execute arbitrary code or commands on the host system.

Users are advised to update to Enclave version 2.10.1, where this vulnerability has been fixed.