Executive Summary

CVE-2026-34156 is a critical security vulnerability in NocoBase's Workflow Script Node, which executes user-supplied JavaScript inside a Node.js vm sandbox. The sandbox uses a custom require allowlist controlled by an environment variable, but it exposes the host environment's WritableWorkerStdio stream objects via console._stdout and console._stderr inside the sandbox context.

An authenticated attacker can exploit this by traversing the prototype chain starting from console._stdout.constructor.constructor to access the host realm's Function constructor. This allows the attacker to execute arbitrary JavaScript code, bypass the require allowlist, load unrestricted modules like 'child_process', and ultimately achieve remote code execution (RCE) as root inside the Docker container running NocoBase.

The vulnerability was patched in version 2.0.28 by preventing exploitation through the prototype chain of console._stdout, thereby mitigating sandbox escape and RCE risks.

Useful 0 Not Useful 0

Compliance Impact

CVE-2026-34156 allows an authenticated attacker to achieve remote code execution as root inside the Docker container running NocoBase. This can lead to theft of sensitive environment variables such as database passwords and root passwords, arbitrary file read/write, and reverse shell capabilities enabling lateral movement.

Such unauthorized access and control over sensitive data and system resources can result in violations of data protection regulations like GDPR and HIPAA, which require strict controls over personal and sensitive information to prevent unauthorized access, disclosure, and modification.

Therefore, exploitation of this vulnerability could compromise confidentiality, integrity, and availability of sensitive data, potentially leading to non-compliance with these common standards and regulations.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an authenticated attacker to execute arbitrary code with root privileges inside the Docker container running NocoBase.

• Remote code execution as root (uid=0) inside the container.
• Theft of sensitive environment variables such as database passwords.
• Arbitrary file read and write access via the filesystem module.
• Ability to open reverse shells, enabling outbound network access and lateral movement within the network.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the exploit vector that involves sending a specially crafted HTTP POST request to the /api/flow_nodes:test endpoint of the NocoBase application. A proof-of-concept involves executing the command `id` via remote code execution, which returns root user information if the system is vulnerable.

To detect the vulnerability, you can attempt to send an authenticated POST request to the endpoint /api/flow_nodes:test with a payload that tries to exploit the prototype chain traversal via console._stdout.constructor.constructor to execute arbitrary commands.

Example command using curl (assuming you have valid authentication tokens or session cookies):

• curl -X POST https://your-nocobase-instance/api/flow_nodes:test -H 'Authorization: Bearer <token>' -H 'Content-Type: application/json' -d '{"script":"return console._stdout.constructor.constructor('return process')().mainModule.require('child_process').execSync('id').toString()"}'

If the response returns user information such as uid=0(root), the system is vulnerable.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading NocoBase to version 2.0.28 or later, where the vulnerability has been patched.

Additional recommended actions are:

• Replace the Node.js vm module with isolated-vm to ensure true V8 isolate separation.
• Avoid passing the host console object into the sandbox; instead, use a clean proxy object.
• Run the application as a non-root user inside Docker containers to limit the impact of potential exploits.
• Restrict access to the /api/flow_nodes:test endpoint to admin-only roles to reduce the attack surface.

Useful 0 Not Useful 0