Enclave VM Sandbox Escape RCE (CVE-2026-27597)
Enclave is a JavaScript sandbox used to let AI agents run untrusted code safely. A critical flaw lets attacker-supplied code break out of that sandbox and run with the privileges of the host process, meaning any AI agent that evaluates untrusted code through Enclave can be fully compromised.
How the attack works
An attacker gets code into a path that ends up evaluated inside `@enclave-vm/core` — for example by getting an AI agent to run submitted code, generated code, or user input through the sandbox. That code uses one of several known JavaScript-sandbox escape tricks: reaching the real Function constructor via `.constructor.constructor`, polluting the prototype chain until it reaches the host realm, abusing `Error.prepareStackTrace` to grab host objects, or calling `require`/`process` to reach Node.js APIs directly. Any of these breaks out of the intended sandbox boundary and executes with host-level access instead of the restricted sandbox context. From there the attacker can read files, exfiltrate secrets, or pivot to other systems the host process can reach.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- e532e5b6-b285-4dee-99eb-460914a587a1
- Severity
- Critical
- CVEs
- CVE-2026-27597
Why it matters
Any application using Enclave versions before 2.11.1 to isolate untrusted or agent-generated code can be fully taken over, giving an attacker the same access as the host process — including data the sandbox was supposed to protect.
What you can do
- →Upgrade `@enclave-vm/core` to version 2.11.1 or later.
- →Until patched, avoid evaluating any untrusted, user-supplied, or LLM-generated code through Enclave.
- →Run sandbox processes with the least privilege possible (restricted filesystem access, no direct network/process access) so an escape has less to reach.
- →Review any code paths where AI agents pass generated or third-party code into Enclave for evaluation, and treat that data as untrusted input.
Known benign look-alikes
- Defensive documentation describing sandbox-escape techniques for educational or research purposes.
- Static analysis output reporting these patterns in dependencies.
- Security research write-ups discussing CVE-2026-27597 with quoted bypass code.