What is the CVSS score of CVE-2026-22686?

CVE-2026-22686 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2026-22686?

Yes, a public proof-of-concept exploit is available for CVE-2026-22686. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-22686?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Validate that input sanitization is in place for all user-controlled parameters.

Enclave CVE-2026-22686

CRITICAL

Code Injection (CWE-94)

2026-01-14 security-advisories@github.com

GHSA-7qm7-455j-5p63

Node.js AI / ML Enclave Agentfront

10.0

CVSS 3.1 · GitHub Advisory

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Trigger tool invocation failure
Exploit

Expose host Error object to sandbox
Execution

Traverse prototype chain to Function
Impact

Execute arbitrary host code

Vulnerability Assessment

Weakness	CWE CWE-94 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Code injection prevention, sandbox exec MITRE ATT&CK 2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Enclave-vm versions prior to 2.7.0 with sandboxed JavaScript code execution enabled. No authentication required; exploitation occurs when tool invocation fails, exposing host Error objects to untrusted sandbox context.
Impact	CVSS 10.0 (Critical). No auth, scope change. PoC available. This is an AI sandbox escape – particularly dangerous as AI agents execute untrusted code. EPSS 0.20%. Patch available.
Exploit ScenarioDerived	An AI agent runs untrusted code in enclave-vm. The code intentionally triggers a tool error, receives the host Error object, traverses its prototype chain to access require(), and loads child_process to execute arbitrary commands on the host.

Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

enclave-vm JavaScript sandbox (before 2.7.0) has a critical sandbox escape. When a tool invocation fails, a host-side Error object is exposed to sandboxed code, which can use its prototype chain to access the host Node.js runtime. Maximum CVSS 10.0 with scope change. PoC available, patch available.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 21:54 CVSS 10.0

enclave-vm sandbox escape via Error object prototype chain access enables full host Node.js runtime compromise.

RemediationAI

Update to enclave-vm 2.7.0 or later. This is critical for any AI agent sandbox deployment.

Affected Packages

npm enclave-vm fix: 2.7.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

When a tool call fails, enclave-vm exposes a host Error object to the sandbox (CWE-94). The Error retains its host realm prototype chain. Sandboxed code traverses the prototype chain to access host-side constructors, enabling arbitrary code execution in the host Node.js process.

Know when Enclave gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

Feb 24, 2026 - 19:23 vuln.today

Public exploit code

Patch released

Feb 24, 2026 - 19:23 nvd

Patch available

CVE Published

Jan 14, 2026 - 00:15 nvd

CRITICAL 10.0

DescriptionGitHub Advisory

Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to 2.7.0, there is a critical sandbox escape vulnerability in enclave-vm that allows untrusted, sandboxed JavaScript code to execute arbitrary code in the host Node.js runtime. When a tool invocation fails, enclave-vm exposes a host-side Error object to sandboxed code. This Error object retains its host realm prototype chain, which can be traversed to reach the host Function constructor. An attacker can intentionally trigger a host error, then climb the prototype chain. Using the host Function constructor, arbitrary JavaScript can be compiled and executed in the host context, fully bypassing the sandbox and granting access to sensitive resources such as process.env, filesystem, and network. This breaks enclave-vm’s core security guarantee of isolating untrusted code. This vulnerability is fixed in 2.7.0.

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

9 npm packages depend on enclave-vm (2 direct, 7 indirect)

Ecosystem-wide dependent count for version 2.7.0.

Executive ViewAI

Why It Matters

Organizations using Enclave face critical risk from CVE-2026-22686, a code injection vulnerability rated CVSS 10.0. Successful exploitation could allow attackers to execute arbitrary code or commands on affected systems, potentially leading to full system compromise. Proof-of-concept code is publicly available, increasing the risk of exploitation. A patch is available and should be applied immediately given the critical severity.

Business Impact: Severe

Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Deploy WAF rules to block injection patterns; (2) Restrict network access to affected components; (3) Enable enhanced logging for suspicious activity.

Threat Intelligence Overview

EPSS Score

0.2%

Top 58% exploitable

Exploit

POC

Public exploit code exists

Data Quality

4 sources

Confidence: Medium

NVD

CVE.org

EPSS

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC Yes

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity + public POC available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.