nocobase plugin-workflow-javascript vulnerabilities

Latest nocobase plugin-workflow-javascript CVEs

Newest publication first

1. CVE-2026-6224 nocobase plugin-workflow-javascript Vm.js createSafeConsole sandbox

   Published 2026-04-13

   Medium·CVSS 6.9

   A security flaw has been discovered in nocobase plugin-workflow-javascript up to 2.0.23. This issue affects the function createSafeConsole of the file packages/plugins/@nocobase/plugin-workflow-javascript/src/server/Vm.js. Performing a manipulation results in sandbox issue. The a...

2. CVE-2026-34156 NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node

   Published 2026-03-31

   Critical·CVSS 10.0 EPSS 35.0%

   NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.28, NocoBase's Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allowlist (controlled by W...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.