CVE-2026-34156

NocoBase prior to version 2.0.28 runs user-supplied JavaScript in its Workflow Script Node inside a Node.js vm sandbox with a require allowlist set by the WORKFLOW_SCRIPT_MODULES environment variable. The console object injected into the sandbox exposes host-realm WritableWorkerStdio stream objects through console._stdout and console._stderr, allowing an authenticated attacker to traverse the prototype chain and break out of the sandbox. A successful escape yields remote code execution running as root on the host. Any NocoBase deployment before 2.0.28 that permits authenticated users to create or edit workflow script nodes is affected. No confirmed in-the-wild exploitation is reported yet, but a public proof-of-concept exists and EPSS assigns a 35% probability of exploitation within 30 days (98th percentile).

What to do: Upgrade NocoBase to version 2.0.28 or later. If upgrading is not immediately possible, restrict workflow script node permissions to trusted administrators and review workflow execution logs for unexpected commands. Internet-exposed instances should be prioritized, since the flaw is network-exploitable by any authenticated low-privileged user and public PoC code is available.