CVE-2026-34156

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.28, NocoBase's Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allowlist (controlled by WORKFLOW_SCRIPT_MODULES env var). However, the console object passed into the sandbox context exposes host-realm WritableWorkerStdio stream objects via console._stdout and console._stderr. An authenticated attacker can traverse the prototype chain to escape the sandbox and achieve Remote Code Execution as root. This issue has been patched in version 2.0.28.

• CWE-913

• https://github.com/nocobase/nocobase/pull/8967Issue Tracking, Patch
• https://github.com/nocobase/nocobase/releases/tag/v2.0.28Product, Release Notes
• https://github.com/nocobase/nocobase/security/advisories/GHSA-px3p-vgh9-m57cExploit, Mitigation, Vendor Advisory

Published

Mar 31, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34150Wazuh is a free and open source platform used for threat pre…7.5
• CVE-2026-34151XWiki Platform is a generic wiki platform. Prior to 17.10.5 …8.2
• CVE-2026-34152Coolify is an open-source and self-hostable tool for managin…8.8
• CVE-2026-34153Coolify is an open-source and self-hostable tool for managin…8.8
• CVE-2026-34154Discourse is an open-source discussion platform. In versions…5.3
• CVE-2026-34155RAUC controls the update process on embedded Linux systems. …5.3
• CVE-2026-34158Coolify is an open-source and self-hostable tool for managin…8.8
• CVE-2026-34159llama.cpp is an inference of several LLM models in C/C++. Pr…9.8
• CVE-2026-3416The API Publisher component previously used a non-cryptograp…7.5
• CVE-2026-34160Chamilo LMS is an open-source learning management system. In…8.6
• CVE-2026-34161Chamilo LMS is an open-source learning management system. In…5.4
• CVE-2026-34162FastGPT is an AI Agent building platform. Prior to version 4…10