Critical, CVSS 9.9npmAmendedPublished
NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node
CVE-2026-34156 · GHSA-px3p-vgh9-m57c
- Affected
- npm @nocobase/plugin-workflow-javascript <= 2.0.27
- Fixed in
- 2.0.28· Vendor fix available
- Issue
- NocoBase's Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allowlist (controlled by WORKFLOWSCRIPTMODULES env var). However, the console object passed into the sandbox context exposes host-realm WritableWorkerStdio stream objects via console.stdout and console.stderr. An authenticated attacker can traverse the prototype chain to escape the sandbox and achieve Remote Code Execution (RCE) as root. Exploit Chain 1. console.stdout.constructor.constructor → host-realm Function constructor 2. Function('return process')() → Node.js process object 3. process.mainModule.require('childprocess') → unrestricted module loading 4. childprocess.execSync('id') → RCE as root This completely bypasses the customRequire allowlist. Impact - Remote Code Execution as root (uid=0) inside Docker container - Database credential theft (DBPASSWORD, INITROOTPASSWORD from process.env) - Arbitrary file read/write via require('fs') - Reverse shell…
Recommended action: Upgrade to 2.0.28 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.