/Vulnerability Library

NocoBase - VM Sandbox Escape to Remote Code Execution

CVE-2026-34156
Verified

Description

NocoBase Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allowlist controlled by WORKFLOW_SCRIPT_MODULES env var. The console object passed into the sandbox context exposes host-realm WritableWorkerStdio stream objects via console._stdout and console._stderr. An authenticated attacker can traverse the prototype chain (console._stdout.constructor.constructor to Function to process to child_process) to escape the sandbox and achieve Remote Code Execution as root.

Severity

Critical

CVSS Score

10

Exploit Probability

7%

Affected Product

nocobase

Published Date

March 31, 2026

Template Author

theamanrawat

CVE-2026-34156.yaml
10.0Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVE ID:
cve-2026-34156
CWE ID:
cwe-913

References

https://github.com/advisories/GHSA-px3p-vgh9-m57chttps://github.com/nocobase/nocobase/security/advisories/GHSA-px3p-vgh9-m57chttps://nvd.nist.gov/vuln/detail/CVE-2026-34156

Remediation Steps

Upgrade to NocoBase version 2.0.28 or later. Replace Node.js vm module with isolated-vm for true V8 isolate separation. Do not pass the host console object into the sandbox. Run the application as a non-root user inside Docker. Restrict /api/flow_nodes:test to admin-only roles.