Critical severity10.0NVD Advisory· Published Feb 25, 2026· Updated Jun 17, 2026
CVE-2026-27597
CVE-2026-27597
Description
Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to version 2.11.1, it is possible to escape the security boundraries set by @enclave-vm/core, which can be used to achieve remote code execution (RCE). The issue has been fixed in version 2.11.1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
@enclave-vm/corenpm | < 2.11.1 | 2.11.1 |
Affected products
3cpe:2.3:a:agentfront:enclave:*:*:*:*:*:node.js:*:*+ 1 more
- cpe:2.3:a:agentfront:enclave:*:*:*:*:*:node.js:*:*range: <2.11.1
- (no CPE)range: < 2.11.1
Patches
Vulnerability mechanics
References
4- github.com/agentfront/enclave/commit/09afbebe4cb6d0586c1145aa71ffabd2103932dbnvdPatchWEB
- github.com/agentfront/enclave/security/advisories/GHSA-f229-3862-4942nvdExploitMitigationVendor AdvisoryWEB
- github.com/advisories/GHSA-f229-3862-4942ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-27597ghsaADVISORY
News mentions
0No linked articles in our index yet.