---
id: CVE-2026-34156
title: >-
  NocoBase is an AI-powered no-code/low-code platform for building business
  applications and enterprise solutions
summary: >-
  NocoBase is an AI-powered no-code/low-code platform for building business
  applications and enterprise solutions. Prior to version 2.0.28, NocoBase's
  Workflow Script Node executes user-supplied JavaScript inside a Node.js vm
  sandbox with …
severity: critical
cvss: 9.9
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
cwe:
  - CWE-913
vendor: nocobase
product: nocobase
affected:
  - nocobase < 2.0.28
patched:
  - nocobase 2.0.28
published: '2026-03-31'
updated: '2026-07-24'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-34156'
references:
  - url: 'https://github.com/nocobase/nocobase/pull/8967'
    label: security-advisories@github.com
  - url: 'https://github.com/nocobase/nocobase/releases/tag/v2.0.28'
    label: security-advisories@github.com
  - url: >-
      https://github.com/nocobase/nocobase/security/advisories/GHSA-px3p-vgh9-m57c
    label: security-advisories@github.com
tags:
  - nvd
  - exploit-available
epss: 0.06793
epssPercentile: 0.93752
exploitAvailable: true
ingestedAt: '2026-07-24T22:40:25.441Z'
exploits:
  exploitdb: true
  github: 2
  githubRepos:
    - 'https://github.com/0xBlackash/CVE-2026-34156'
    - >-
      https://github.com/Dhananjayasj/CVE-2026-34156-NocoBase-Sandbox-Escape-via-Workflow-Execution-Vulnerability-
  nuclei:
    - CVE-2026-34156
  checkedAt: '2026-09-25T08:20:55.366Z'
---

## Overview

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.28, NocoBase's Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allowlist (controlled by WORKFLOW_SCRIPT_MODULES env var). However, the console object passed into the sandbox context exposes host-realm WritableWorkerStdio stream objects via console._stdout and console._stderr. An authenticated attacker can traverse the prototype chain to escape the sandbox and achieve Remote Code Execution as root. This issue has been patched in version 2.0.28.

## Affected

- `nocobase < 2.0.28`

## Remediation

Upgrade past the affected range:

- `nocobase 2.0.28`