# CVE-2026-34156: NocoBase sandbox escape and RCE in Workflow Script Node

Source: https://junglewise.ai/threats/cve-2026-34156-nocobase-sandbox-escape-and-rce-in-workflow-script-node  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-31. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-34156 · Severity: critical · CVSS 9.9 · Published 2026-03-31

NocoBase is a platform used by businesses to build custom applications and enterprise solutions without writing complex code. A security flaw in the platform's workflow automation tool allows an authorized user to bypass security restrictions and run unauthorized commands on the underlying server. This could lead to a total system takeover, theft of sensitive database credentials, and full access to customer data.

Technologies: [Nocobase](https://junglewise.ai/threats/technologies/nocobase). Vendors: [NocoBase](https://junglewise.ai/threats/vendors/nocobase), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-34156 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34156 being exploited in the wild.

**How severe is CVE-2026-34156?** Critical severity, with a CVSS score of 9.9, published 31 March 2026.

**Which products and versions are affected?** Nocobase < 2.0.28; @nocobase/plugin-workflow-javascript (npm) SEMVER:introduced=0,fixed=2.0.28.

**Is there a fix for CVE-2026-34156?** Yes. @nocobase/plugin-workflow-javascript (npm): upgrade to 2.0.28 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34156 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-34156?** Check whether you run Nocobase or @nocobase/plugin-workflow-javascript (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @nocobase/plugin-workflow-javascript (npm): upgrade to 2.0.28 or later

  ```sh
  npm install @nocobase/plugin-workflow-javascript@2.0.28
  ```


## Technical details

A sandbox escape vulnerability exists in NocoBase's Workflow Script Node prior to version 2.0.28. While the platform uses a Node.js 'vm' sandbox with a restricted module allowlist, it improperly passes the host-realm 'console' object into the sandbox context. This object exposes 'WritableWorkerStdio' stream objects via 'console._stdout' and 'console._stderr'. An authenticated attacker can traverse the prototype chain (e.g., console._stdout.constructor.constructor) to access the host-realm Function constructor, retrieve the 'process' object, and load unrestricted modules like 'child_process'. This allows for Remote Code Execution (RCE) with root privileges within the application container. The issue is addressed in version 2.0.28 by improving sandbox isolation.

## Affected products

- NocoBase NocoBase < 2.0.28

## Identifiers

- CVE-2026-34156
- GHSA-px3p-vgh9-m57c

## Timeline

- 2026-03-26: patched: Fix merged in GitHub pull request #8967
- 2026-03-27: advisory: Release v2.0.28 published
- 2026-03-31: disclosed: CVE-2026-34156 published

## References

- [https://github.com/nocobase/nocobase/pull/8967](https://github.com/nocobase/nocobase/pull/8967)
- [https://github.com/nocobase/nocobase/releases/tag/v2.0.28](https://github.com/nocobase/nocobase/releases/tag/v2.0.28)
- [https://github.com/nocobase/nocobase/security/advisories/GHSA-px3p-vgh9-m57c](https://github.com/nocobase/nocobase/security/advisories/GHSA-px3p-vgh9-m57c)

## Related threats

- [NocoBase server-side request forgery in customRequests:send](https://junglewise.ai/threats/cve-2026-79914-nocobase-is-an-ai-powered-no-code-low-code-platform-for-building)
- [NocoBase SQL injection in checkSQL function](https://junglewise.ai/threats/cve-2026-88402-a-sql-injection-vulnerability-in-the-checksql-function-of)
- [NocoBase cross-site scripting in rich text field renderer](https://junglewise.ai/threats/cve-2026-84701-nocobase-cross-site-scripting-in-rich-text-field-renderer)
- [NocoBase arbitrary file write and local file inclusion leading to remote code execution](https://junglewise.ai/threats/nocobase-arbitrary-file-write-and-local-file-inclusion-leading-to-b8ec6b22)
- [NocoBase sensitive data exposure via SQL blacklist bypass in SQL Collection](https://junglewise.ai/threats/cve-2026-52888-nocobase-sensitive-data-exposure-via-sql-blacklist-bypass-in-sql)