Vulnerability library
Security checkMarch 31, 2026

NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node

Understand the exposure, see the recommended fix, and check whether your own website has related weaknesses.

High severitynpm@nocobase/plugin-workflow-javascript

Check your website

Find this and other vulnerabilities with a free scan.

Your scan runs on your computer. No account required.

Description

## Summary

NocoBase’s Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allowlist (controlled by WORKFLOW_SCRIPT_MODULES env var). However, the console object passed into the sandbox context exposes host-realm WritableWorkerStdio stream objects via console._stdout and console._stderr.

Recommendation

Update the @nocobase/plugin-workflow-javascript package to the latest compatible version. Followings are version details:

  • Affected version(s): <= 2.0.27
  • Patched version(s): 2.0.28

References

Could your website be exposed too?

SmartScanner can check your website for NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node and gives you actionable findings to investigate.

Start a free scan

Related Issues

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

Update Cheat Sheet for Developers

See something that needs correcting? Let us knowUpdated March 31, 2026