QwikSec

Security Database

CVE

CWE

Training

CVE-2026-25533

Published: Feb 6, 2026

Modified: Feb 9, 2026

PUBLISHED

Description

Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to 2.10.1, the existing layers of security in enclave-vm are insufficient: The AST sanitization can be bypassed with dynamic property accesses, the hardening of the error objects does not cover the peculiar behavior or the vm module and the function constructor access prevention can be side-stepped by leveraging host object references. This vulnerability is fixed in 2.10.1.

Vendor	Product	Versions
agentfront	enclave	affected `< 2.10.1`

Weaknesses (CWE)

References

https://github.com/agentfront/enclave/security/advisories/GHSA-x39w-8vm5-5m3p

x_refsource_CONFIRM

https://github.com/agentfront/enclave/commit/2fcf5da81e7e2578ede6f94cae4f379165426dca

x_refsource_MISC

https://www.staicu.org/publications/usenixSec2023-SandDriller.pdf

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.