CVE-2026-25533

Katalog CVE

CVSS 8.8 · High EPSS 0,23%

Kerentanan Loop with Unreachable Exit Condition ('Infinite Loop') pada agentfront enclave. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to 2.10.1, the existing layers of security in enclave-vm are insufficient: The AST sanitization can be bypassed with dynamic property accesses, the hardening of the error objects does not cover the peculiar behavior or the vm module and the function constructor access prevention can be side-stepped by leveraging host object references. This vulnerability is fixed in 2.10.1.

Rincian

Terbit di NVD

6 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')

EPSS (30 hari)

0,23% peluang dieksploitasi; lebih tinggi dari 13,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/agentfront/enclave/security/advisories/GHSA-x39w-8vm5-5m3p exploit · advisory vendor
• https://github.com/agentfront/enclave/commit/2fcf5da81e7e2578ede6f94cae4f379165426dca patch
• https://www.staicu.org/publications/usenixSec2023-SandDriller.pdf deskripsi teknis