Is CVE-2026-34156 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34156 being exploited in the wild.

How severe is CVE-2026-34156?

Critical severity, with a CVSS score of 9.9, published 31 March 2026.

Which products and versions are affected?

Nocobase < 2.0.28; @nocobase/plugin-workflow-javascript (npm) SEMVER:introduced=0,fixed=2.0.28.

Is there a fix for CVE-2026-34156?

Yes. @nocobase/plugin-workflow-javascript (npm): upgrade to 2.0.28 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34156 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-34156?

Check whether you run Nocobase or @nocobase/plugin-workflow-javascript (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34156: NocoBase sandbox escape and RCE in Workflow Script Node

Q: Which products and versions are affected?

Nocobase < 2.0.28; @nocobase/plugin-workflow-javascript (npm) SEMVER:introduced=0,fixed=2.0.28.

Q: Is there a fix for CVE-2026-34156?

Yes. @nocobase/plugin-workflow-javascript (npm): upgrade to 2.0.28 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-34156 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-34156?

Check whether you run Nocobase or @nocobase/plugin-workflow-javascript (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34156 · Severity: critical · CVSS 9.9 · Published 2026-03-31

NocoBase is a platform used by businesses to build custom applications and enterprise solutions without writing complex code. A security flaw in the platform's workflow automation tool allows an authorized user to bypass security restrictions and run unauthorized commands on the underlying server. This could lead to a total system takeover, theft of sensitive database credentials, and full access to customer data.

Technologies: Nocobase. Vendors: NocoBase, npm.

Quick answers

Is CVE-2026-34156 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34156 being exploited in the wild.
How severe is CVE-2026-34156?: Critical severity, with a CVSS score of 9.9, published 31 March 2026.
Which products and versions are affected?: Nocobase < 2.0.28; @nocobase/plugin-workflow-javascript (npm) SEMVER:introduced=0,fixed=2.0.28.
Is there a fix for CVE-2026-34156?: Yes. @nocobase/plugin-workflow-javascript (npm): upgrade to 2.0.28 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34156 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-34156?: Check whether you run Nocobase or @nocobase/plugin-workflow-javascript (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@nocobase/plugin-workflow-javascript (npm): upgrade to 2.0.28 or later
```
npm install @nocobase/plugin-workflow-javascript@2.0.28
```

Technical details

A sandbox escape vulnerability exists in NocoBase's Workflow Script Node prior to version 2.0.28. While the platform uses a Node.js 'vm' sandbox with a restricted module allowlist, it improperly passes the host-realm 'console' object into the sandbox context. This object exposes 'WritableWorkerStdio' stream objects via 'console._stdout' and 'console._stderr'. An authenticated attacker can traverse the prototype chain (e.g., console._stdout.constructor.constructor) to access the host-realm Function constructor, retrieve the 'process' object, and load unrestricted modules like 'child_process'. This allows for Remote Code Execution (RCE) with root privileges within the application container. The issue is addressed in version 2.0.28 by improving sandbox isolation.

Affected products

NocoBase NocoBase < 2.0.28

Identifiers

CVE-2026-34156
GHSA-px3p-vgh9-m57c

Timeline

2026-03-26: patched: Fix merged in GitHub pull request #8967
2026-03-27: advisory: Release v2.0.28 published
2026-03-31: disclosed: CVE-2026-34156 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.