CVE-2026-34156

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.28, NocoBase's Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allowlist (controlled by WORKFLOW_SCRIPT_MODULES env var). However, the console object passed into the sandbox context exposes host-realm WritableWorkerStdio stream objects via console._stdout and console._stderr. An authenticated attacker can traverse the prototype chain to escape the sandbox and achieve Remote Code Execution as root. This issue has been patched in version 2.0.28.

CVSS v3 9.9 CRITICAL

9.9^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.1 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/nocobase/nocobase/pull/8967	Issue Tracking Patch
https://github.com/nocobase/nocobase/releases/tag/v2.0.28	Product Release Notes
https://github.com/nocobase/nocobase/security/advisories/GHSA-px3p-vgh9-m57c	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nocobase:nocobase:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-03-31 14:16

Updated : 2026-07-24 22:10

NVD link : CVE-2026-34156

Mitre link : CVE-2026-34156

CVE.ORG link : CVE-2026-34156

JSON object : View

Products Affected

nocobase

nocobase

CWE

CWE-913

Improper Control of Dynamically-Managed Code Resources

{"id": "CVE-2026-34156", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34156", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-02T15:08:26.814719Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.1}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "nocobase", "product": "nocobase", "versions": [{"status": "affected", "version": "< 2.0.28"}]}]}], "published": "2026-03-31T14:16:12.170", "references": [{"url": "https://github.com/nocobase/nocobase/pull/8967", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nocobase/nocobase/releases/tag/v2.0.28", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nocobase/nocobase/security/advisories/GHSA-px3p-vgh9-m57c", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-913"}]}], "descriptions": [{"lang": "en", "value": "NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.28, NocoBase's Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allowlist (controlled by WORKFLOW_SCRIPT_MODULES env var). However, the console object passed into the sandbox context exposes host-realm WritableWorkerStdio stream objects via console._stdout and console._stderr. An authenticated attacker can traverse the prototype chain to escape the sandbox and achieve Remote Code Execution as root. This issue has been patched in version 2.0.28."}, {"lang": "es", "value": "NocoBase es una plataforma no-code/low-code impulsada por IA para construir aplicaciones de negocio y soluciones empresariales. Antes de la versi\u00f3n 2.0.28, el Nodo de Script de Flujo de Trabajo de NocoBase ejecuta JavaScript proporcionado por el usuario dentro de una sandbox vm de Node.js con una lista de permitidos de 'require' personalizada (controlada por la variable de entorno WORKFLOW_SCRIPT_MODULES). Sin embargo, el objeto 'console' pasado al contexto de la sandbox expone objetos de flujo 'WritableWorkerStdio' del \u00e1mbito del host a trav\u00e9s de 'console._stdout' y 'console._stderr'. Un atacante autenticado puede recorrer la cadena de prototipos para escapar de la sandbox y lograr la ejecuci\u00f3n remota de c\u00f3digo como 'root'. Este problema ha sido parcheado en la versi\u00f3n 2.0.28."}], "lastModified": "2026-07-24T22:10:00.140", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nocobase:nocobase:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2F4BBE86-4C61-42A4-B11E-1AFFE76B84B9", "versionEndExcluding": "2.0.28"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}