CVE-2026-34156

Name of the Vulnerable Software and Affected Versions NocoBase versions prior to 2.0.28

Description NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. The Workflow Script Node executes user-supplied JavaScript within a Node.js vm sandbox that utilizes a custom require allowlist controlled by the WORKFLOW SCRIPT MODULES environment variable. However, the console object provided to the sandbox context exposes host-realm WritableWorkerStdio stream objects through console. stdout and console. stderr.

An authenticated attacker can traverse the prototype chain to escape the sandbox and achieve Remote Code Execution (RCE) with root privileges. The exploitation chain involves accessing the host-realm Function constructor via console. stdout.constructor.constructor, which allows the attacker to access the Node.js process object and load the child process module to execute arbitrary commands. This bypasses the customRequire allowlist and can lead to database credential theft, arbitrary file read/write, and the establishment of a reverse shell.

The issue can be triggered via the /api/flow nodes:test endpoint using the content parameter within the request body.

Recommendations Update NocoBase to version 2.0.28 or later. Restrict access to the /api/flow nodes:test endpoint to admin-only roles. Run the application as a non-root user inside Docker containers.