CVE-2026-34156

The Workflow Script Node executes JavaScript code supplied by the user inside a Node.js vm sandbox with a custom whitelist of allowed modules (controlled by the WORKFLOW_SCRIPT_MODULES environment variable). The console object is passed to the sandbox context, which through the console._stdout and console._stderr properties exposes WritableWorkerStdio stream objects belonging to the host namespace. An attacker can traverse the prototype chain of these objects to escape the sandbox isolation and gain access to the host environment. As a result, arbitrary JavaScript code execution outside the sandbox with root privileges is possible.

An attacker can achieve complete remote code execution (RCE) with root privileges on the server hosting the NocoBase application, which in practice means complete system takeover, data access, and the ability to further spread through the network.

NocoBase should be immediately updated to version 2.0.28 or newer, in which the vulnerability has been patched. Details are available in the official vendor references (GitHub Security Advisory GHSA-px3p-vgh9-m57c and release tag v2.0.28).

NocoBase in all versions prior to 2.0.28