关键信息 漏洞概述 漏洞名称: Sandbox Escape via Host Error Prototype Chain in enclave-vm CVE ID: CVE-2026-22686 GHSA ID: GHSA-7qm7-455j-5p63 影响版本与修复版本 受影响版本: <2.6.0 修复版本: 2.7.0 漏洞描述 严重性: Critical (10.0/10) CVSS v3.1: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H 漏洞细节 A critical sandbox escape vulnerability exists in enclave-vm that allows untrusted, sandboxed JavaScript to execute arbitrary code in the host Node.js runtime. The vulnerability exposes a host-side Error object to sandboxed code, breaking the sandbox boundary and potentially granting access to sensitive resources like , filesystem, and network. 生态系统影响 FrontMCP / CodeCall: Treat this as an urgent upgrade and ensure your runtime is on a patched enclave-vm version. 时间线 修复发布: Jan 9, 2026 (enclave-vm@2.7.0) 公告发布: Jan 13, 2026 缓解措施 立即行动: 升级 enclave-vm to 2.7.0+ 纵深防御建议: - Re-create all Error objects crossing the sandbox boundary inside the sandbox realm - Strip / freeze prototype chains of host objects - Prevent access to host constructors - Harden tool error handling to avoid leaking host-native objects 参考资料 GitHub Security Advisory npm package Enclave repo FrontMCP docs CodeCall plugin overview EnclaveVM Playground