Description
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.28, NocoBase's Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allowlist (controlled by WORKFLOW_SCRIPT_MODULES env var). However, the console object passed into the sandbox context exposes host-realm WritableWorkerStdio stream objects via console._stdout and console._stderr. An authenticated attacker can traverse the prototype chain to escape the sandbox and achieve Remote Code Execution as root. This issue has been patched in version 2.0.28.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nocobase | nocobase | < 2.0.28 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- NocoBase 2.0.27 - VM Sandbox Escape EDB-52552 · local · May 7, 2026
GitHub 2 repositories
-
ashrafzaryouh/CVE-2026-34156 ★ 0 · Apr 3, 2026
CVE-2026-34156
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- NocoBase - VM Sandbox Escape to Remote Code Execution http/cves/2026/CVE-2026-34156.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @nocobase/plugin-workflow-javascript | < 2.0.28 | 2.0.28 | GHSA-px3p-vgh9-m57c |