What is the CVSS score of CVE-2026-27597?

CVE-2026-27597 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Is there a public PoC exploit available for CVE-2026-27597?

Yes, a public proof-of-concept exploit is available for CVE-2026-27597. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2026-27597?

Within 24 hours: Identify all systems running Enclave versions <2.11.1 and assess their exposure to untrusted code sources; isolate critical instances if patching cannot be completed immediately. Within 7 days: Apply vendor patch to version 2.11.1 or later across all affected systems; verify patch deployment through version scanning. Within 30 days: Conduct post-incident review of any suspicious activity during the vulnerability window; review and strengthen code review processes for AI agent deployments.

Enclave CVE-2026-27597

Q: Which versions of Enclave are affected by CVE-2026-27597?

A critical vulnerability in Enclave's JavaScript sandbox allows attackers to bypass security controls and execute arbitrary code remotely with a 10.0 CVSS score.. A patch is available.

CRITICAL

Code Injection (CWE-94)

2026-02-25 security-advisories@github.com

GHSA-f229-3862-4942

RCE AI / ML Enclave Agentfront

10.0

CVSS 3.1 · GitHub Advisory

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Send malicious JavaScript to Enclave sandbox
Exploit

Exploit sandbox boundary escape vulnerability
Execution

Access host system resources
Impact

Execute arbitrary code remotely

Vulnerability Assessment

Weakness	CWE CWE-94 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Code injection prevention, sandbox exec MITRE ATT&CK 2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Enclave versions prior to 2.11.1 with @enclave-vm/core sandbox enabled. No special conditions — remote unauthenticated exploitation against default Enclave deployments accepting external JavaScript code.
Impact	CVSS 10.0. AI safety critical — if AI agents can escape the sandbox, they can access the host system, exfiltrate data, or cause physical harm depending on the deployment context.
Exploit ScenarioDerived	AI agent generates code that exploits the sandbox escape, gains access to the host system, reads/modifies files, makes network requests, or executes arbitrary commands.

Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.

Patch available 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Sandbox escape in Enclave JavaScript sandbox before 2.11.1. Enclave is designed for safe AI agent code execution — the escape allows agents to execute arbitrary code outside the sandbox. CVSS 10.0, PoC and patch available.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 21:55 CVSS 10.0

Sandbox escape in Enclave AI agent code execution sandbox.

RemediationAI

Update to Enclave 2.11.1 immediately. Audit AI agent execution logs for suspicious activity.

Affected Packages

npm @enclave-vm/core fix: 2.11.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

CWE-94 code injection bypassing sandbox restrictions. Enclave is specifically designed to safely execute AI-generated code — the sandbox escape undermines its core security guarantee.

Know when Enclave gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

Feb 27, 2026 - 18:27 vuln.today

Public exploit code

Patch released

Feb 27, 2026 - 18:27 nvd

Patch available

CVE Published

Feb 25, 2026 - 04:16 nvd

CRITICAL 10.0

DescriptionGitHub Advisory

Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to version 2.11.1, it is possible to escape the security boundraries set by @enclave-vm/core, which can be used to achieve remote code execution (RCE). The issue has been fixed in version 2.11.1.

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 npm packages depend on @enclave-vm/core (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 2.11.1.

Articles & Coverage 1

POC CVE-2026-27597: Agentfront Enclave Sandbox Escape RCE (CVSS 10.0) Apr 19, 2026

Executive ViewAI

Why It Matters

A critical vulnerability in Enclave's JavaScript sandbox allows attackers to bypass security controls and execute arbitrary code remotely with a 10.0 CVSS score. Any organization running Enclave versions prior to 2.11.1 for AI agent execution faces immediate risk of complete system compromise and data breach, particularly if the sandbox processes untrusted code or external inputs.

Business Impact: Severe

Compensating Controls

Apply vendor patch. If immediate patching is not possible: disable Enclave sandbox functionality until patched; restrict network access to Enclave instances through firewall rules; implement strict input validation and sanitization for all code passed to the sandbox; run Enclave in isolated container environments with minimal host system access; monitor for exploitation attempts using IDS/IPS.

Threat Intelligence Overview

EPSS Score

0.5%

Top 34% exploitable

Threat Intel

1 source

Exploit

POC

Public exploit code exists

Data Quality

4 sources

Confidence: Medium

NVD

CVE.org

EPSS GHSA

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC Yes

EPSS 0.5%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity + public POC available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.