Enclave

3 CVEs product

Monthly

Sort: Newest CVSS Score EPSS Score Oldest

CVE-2026-27597 Feb 25, 04:16 npm CRITICAL POC PATCH GHSA Act Now

Sandbox escape in Enclave JavaScript sandbox before 2.11.1. Enclave is designed for safe AI agent code execution — the escape allows agents to execute arbitrary code outside the sandbox. CVSS 10.0, PoC and patch available.

RCE AI / ML Enclave Agentfront

NVD GitHub

CVSS 3.1

10.0

EPSS

0.5%

CVE-2026-25533 Feb 06, 22:16 npm HIGH POC PATCH This Week

Enclave versions up to 2.10.1 is affected by loop with unreachable exit condition (infinite loop) (CVSS 8.8).

RCE Denial Of Service AI / ML Enclave Agentfront

NVD GitHub

CVSS 3.1

8.8

EPSS

0.0%

CVE-2026-22686 Jan 14, 00:15 npm CRITICAL POC PATCH Act Now

enclave-vm JavaScript sandbox (before 2.7.0) has a critical sandbox escape. When a tool invocation fails, a host-side Error object is exposed to sandboxed code, which can use its prototype chain to access the host Node.js runtime. Maximum CVSS 10.0 with scope change. PoC available, patch available.

Node.js AI / ML Enclave Agentfront

NVD GitHub

CVSS 3.1

10.0

EPSS

0.2%

CVE-2026-27597 npm

EPSS 1% CVSS 10.0

CRITICAL POC PATCH Act Now

RCE AI / ML Enclave +1

NVD GitHub

CVE-2026-25533 npm

EPSS 0% CVSS 8.8

HIGH POC PATCH This Week

Enclave versions up to 2.10.1 is affected by loop with unreachable exit condition (infinite loop) (CVSS 8.8).

RCE Denial Of Service AI / ML +2

NVD GitHub

CVE-2026-22686 npm

EPSS 0% CVSS 10.0

CRITICAL POC PATCH Act Now

Node.js AI / ML Enclave +1

NVD GitHub