FixVibe
Covered by FixVibecritical

NocoBase Sandbox Escape and Remote Code Execution (CVE-2026-34156)

NocoBase @nocobase/plugin-workflow-javascript versions through 2.0.27 are affected by CVE-2026-34156. An authenticated user who can run a Workflow Script Node may escape its sandbox and execute code on the host. FixVibe repo scans now report exact affected dependency evidence; that evidence is a patch signal, not proof of reachability or exploitation.

CVE-2026-34156CWE-913

Impact

CVE-2026-34156 affects @nocobase/plugin-workflow-javascript through version 2.0.27 and is fixed in 2.0.28 [S1][S2][S3]. An authenticated user with permission to execute a Workflow Script Node could escape the intended JavaScript sandbox and run code in the NocoBase host process context [S1]. The vendor and reviewed GitHub advisory rate the issue Critical at CVSS 9.9, while the required authenticated workflow access remains an important deployment-specific precondition [S1][S2].

Root cause

The vulnerable Workflow Script Node exposed console streams created in the host JavaScript realm to sandboxed code. Those host-realm objects could be abused to cross the sandbox boundary, defeating the intended isolation [S1]. NocoBase corrected the implementation in the 2.0.28 release [S4][S5].

How FixVibe covers it

FixVibe GitHub repo scans report the exact @nocobase/plugin-workflow-javascript package when an affected version is present in supported npm manifests or npm, Yarn, and pnpm lockfiles. Findings show the repository source, package and version evidence, affected range, patched version, and advisory references.

This is a version-based advisory. FixVibe does not fingerprint NocoBase versions from a live site, authenticate to the workflow editor, inspect workflow configuration, create or test Workflow Script Nodes, execute JavaScript, attempt a sandbox escape, determine the deployed process user, or claim that host execution or compromise occurred.

Remediation

Upgrade NocoBase and @nocobase/plugin-workflow-javascript to version 2.0.28 or newer [S1][S4]. Regenerate the active lockfile, rebuild server and container artifacts, and verify the deployed dependency tree. Restrict workflow editing and Script Node testing to trusted administrators, run the service with least-privilege credentials as a non-root user, and review workflow or audit logs if untrusted users may have had access before the upgrade.

Sources

  • NocoBase security advisory [S1]
  • GitHub reviewed advisory [S2]
  • NVD CVE record [S3]
  • NocoBase 2.0.28 release [S4]
  • Upstream fix pull request [S5]
NocoBase Sandbox Escape and Remote Code Execution (CVE-2026-34156) — FixVibe research · FixVibe