Agentfront
Monthly
Sandbox escape leading to remote code execution in FrontMCP (agentfront/frontmcp) before 1.5.7 lets a single tools/call to the codecall:execute tool break out of the script sandbox and run arbitrary code as the server user. The security membrane hands back live host Zod v4 schema instances via getTool(), giving script authors a path to the host Function constructor and full process control, exposing OAuth client secrets, JWT_SECRET, session keys, database credentials, and cloud metadata. Because the framework ships DEFAULT_AUTH_OPTIONS in public mode, unconfigured servers expose this to unauthenticated callers, and publicly available exploit code exists in the form of the fix commit's regression tests demonstrating the exact escape technique.
Sandbox escape in Enclave JavaScript sandbox before 2.11.1. Enclave is designed for safe AI agent code execution — the escape allows agents to execute arbitrary code outside the sandbox. CVSS 10.0, PoC and patch available.
Enclave versions up to 2.10.1 is affected by loop with unreachable exit condition (infinite loop) (CVSS 8.8).
enclave-vm JavaScript sandbox (before 2.7.0) has a critical sandbox escape. When a tool invocation fails, a host-side Error object is exposed to sandboxed code, which can use its prototype chain to access the host Node.js runtime. Maximum CVSS 10.0 with scope change. PoC available, patch available.
Sandbox escape leading to remote code execution in FrontMCP (agentfront/frontmcp) before 1.5.7 lets a single tools/call to the codecall:execute tool break out of the script sandbox and run arbitrary code as the server user. The security membrane hands back live host Zod v4 schema instances via getTool(), giving script authors a path to the host Function constructor and full process control, exposing OAuth client secrets, JWT_SECRET, session keys, database credentials, and cloud metadata. Because the framework ships DEFAULT_AUTH_OPTIONS in public mode, unconfigured servers expose this to unauthenticated callers, and publicly available exploit code exists in the form of the fix commit's regression tests demonstrating the exact escape technique.
Sandbox escape in Enclave JavaScript sandbox before 2.11.1. Enclave is designed for safe AI agent code execution — the escape allows agents to execute arbitrary code outside the sandbox. CVSS 10.0, PoC and patch available.
Enclave versions up to 2.10.1 is affected by loop with unreachable exit condition (infinite loop) (CVSS 8.8).
enclave-vm JavaScript sandbox (before 2.7.0) has a critical sandbox escape. When a tool invocation fails, a host-side Error object is exposed to sandboxed code, which can use its prototype chain to access the host Node.js runtime. Maximum CVSS 10.0 with scope change. PoC available, patch available.