# Enclave VM Sandbox Escape RCE (CVE-2026-27597)

- **Severity:** Critical
- **Signature ID:** `e532e5b6-b285-4dee-99eb-460914a587a1`
- **CVEs:** CVE-2026-27597
- **MITRE ATLAS:** AML.T0049 (Exploit Public-Facing Application), AML.T0050 (Command and Scripting Interpreter), AML.T0105 (Escape to Host)
- **OWASP:** ASI05 (Cascading Failures in Multi-Agent Systems), ASI06 (Goal and Instruction Manipulation), LLM02 (Sensitive Information Disclosure), LLM05 (Improper Output Handling)

## Summary

Enclave is a JavaScript sandbox used to let AI agents run untrusted code safely. A critical flaw lets attacker-supplied code break out of that sandbox and run with the privileges of the host process, meaning any AI agent that evaluates untrusted code through Enclave can be fully compromised.

## How the attack works

An attacker gets code into a path that ends up evaluated inside `@enclave-vm/core` — for example by getting an AI agent to run submitted code, generated code, or user input through the sandbox. That code uses one of several known JavaScript-sandbox escape tricks: reaching the real Function constructor via `.constructor.constructor`, polluting the prototype chain until it reaches the host realm, abusing `Error.prepareStackTrace` to grab host objects, or calling `require`/`process` to reach Node.js APIs directly. Any of these breaks out of the intended sandbox boundary and executes with host-level access instead of the restricted sandbox context. From there the attacker can read files, exfiltrate secrets, or pivot to other systems the host process can reach.

## Why it matters

Any application using Enclave versions before 2.11.1 to isolate untrusted or agent-generated code can be fully taken over, giving an attacker the same access as the host process — including data the sandbox was supposed to protect.

## What you can do

- Upgrade `@enclave-vm/core` to version 2.11.1 or later.
- Until patched, avoid evaluating any untrusted, user-supplied, or LLM-generated code through Enclave.
- Run sandbox processes with the least privilege possible (restricted filesystem access, no direct network/process access) so an escape has less to reach.
- Review any code paths where AI agents pass generated or third-party code into Enclave for evaluation, and treat that data as untrusted input.

## Known benign look-alikes

- Defensive documentation describing sandbox-escape techniques for educational or research purposes.
- Static analysis output reporting these patterns in dependencies.
- Security research write-ups discussing CVE-2026-27597 with quoted bypass code.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00436
- https://nvd.nist.gov/vuln/detail/CVE-2026-27597

---
Source: https://www.netzilo.com/threats/atr-enclave-vm-sandbox-escape-rce-cve-2026-27597