NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node

Description

## Summary

NocoBase’s Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allowlist (controlled by WORKFLOW_SCRIPT_MODULES env var). However, the console object passed into the sandbox context exposes host-realm WritableWorkerStdio stream objects via console._stdout and console._stderr.

Recommendation

Update the @nocobase/plugin-workflow-javascript package to the latest compatible version. Followings are version details:

• Affected version(s): <= 2.0.27
• Patched version(s): 2.0.28

References

• GHSA-px3p-vgh9-m57c
• CVE-2026-34156
• CWE-913
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• enclave-vm Vulnerable to Sandbox Escape via Host Error Prototype Chain - CVE-2026-22686
• OneUptime:: node:vm sandbox escape in probe allows any project member to achieve RCE - CVE-2026-27574
• Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override - CVE-2026-69254
• OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment - CVE-2026-41900

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

Update Cheat Sheet for Developers

Tags:

npm

@nocobase/plugin-workflow-javascript