Skip to content
OpenAdvisories

Package · npm

@nocobase/plugin-workflow-javascript

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 10.0
    CVE-2026-34156 Public exploit EPSS 35%

    NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node

    NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.28, NocoBase's Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allow…

    nocobase nocobase @nocobase/plugin-workflow-javascript npm