Onurcangnc

**Name of the Vulnerable Software and Affected Versions** NocoBase versions prior to 2.0.28 **Description** NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. The Workflow Script Node executes user-supplied JavaScript within a Node.js `vm` sandbox that utilizes a custom `require` allowlist controlled by the `WORKFLOW SCRIPT MODULES` environment variable. However, the `console` object provided to the sandbox context exposes host-realm `WritableWorkerStdio` stream objects through `console. stdout` and `console. stderr`. An authenticated attacker can traverse the prototype chain to escape the sandbox and achieve Remote Code Execution (RCE) with root privileges. The exploitation chain involves accessing the host-realm `Function` constructor via `console. stdout.constructor.constructor`, which allows the attacker to access the Node.js `process` object and load the `child process` module to execute arbitrary commands. This bypasses the `customRequire` allowlist and can lead to database credential theft, arbitrary file read/write, and the establishment of a reverse shell. The issue can be triggered via the `/api/flow nodes:test` endpoint using the `content` parameter within the request body. **Recommendations** Update NocoBase to version 2.0.28 or later. Restrict access to the `/api/flow nodes:test` endpoint to admin-only roles. Run the application as a non-root user inside Docker containers.