Executive brief
NocoBase is a platform used by businesses to build custom applications and enterprise solutions without writing complex code. A security flaw in the platform's workflow automation tool allows an authorized user to bypass security restrictions and run unauthorized commands on the underlying server. This could lead to a total system takeover, theft of sensitive database credentials, and full access to customer data.
Technical details
A sandbox escape vulnerability exists in NocoBase's Workflow Script Node prior to version 2.0.28. While the platform uses a Node.js 'vm' sandbox with a restricted module allowlist, it improperly passes the host-realm 'console' object into the sandbox context. This object exposes 'WritableWorkerStdio' stream objects via 'console._stdout' and 'console._stderr'. An authenticated attacker can traverse the prototype chain (e.g., console._stdout.constructor.constructor) to access the host-realm Function constructor, retrieve the 'process' object, and load unrestricted modules like 'child_process'. This allows for Remote Code Execution (RCE) with root privileges within the application container. The issue is addressed in version 2.0.28 by improving sandbox isolation.
Affected products
- NocoBase NocoBase < 2.0.28
Timeline
- 2026-03-26: patched: Fix merged in GitHub pull request #8967
- 2026-03-27: advisory: Release v2.0.28 published
- 2026-03-31: disclosed: CVE-2026-34156 published