CVE-2026-34156

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34156", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-25T20:12:04.196Z", "datePublished": "2026-03-31T13:33:11.325Z", "dateUpdated": "2026-04-02T15:08:38.165Z"}, "containers": {"cna": {"title": "NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node", "problemTypes": [{"descriptions": [{"cweId": "CWE-913", "lang": "en", "description": "CWE-913: Improper Control of Dynamically-Managed Code Resources", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/nocobase/nocobase/security/advisories/GHSA-px3p-vgh9-m57c", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nocobase/nocobase/security/advisories/GHSA-px3p-vgh9-m57c"}, {"name": "https://github.com/nocobase/nocobase/pull/8967", "tags": ["x_refsource_MISC"], "url": "https://github.com/nocobase/nocobase/pull/8967"}, {"name": "https://github.com/nocobase/nocobase/releases/tag/v2.0.28", "tags": ["x_refsource_MISC"], "url": "https://github.com/nocobase/nocobase/releases/tag/v2.0.28"}], "affected": [{"vendor": "nocobase", "product": "nocobase", "versions": [{"version": "< 2.0.28", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-31T13:33:11.325Z"}, "descriptions": [{"lang": "en", "value": "NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.28, NocoBase's Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allowlist (controlled by WORKFLOW_SCRIPT_MODULES env var). However, the console object passed into the sandbox context exposes host-realm WritableWorkerStdio stream objects via console._stdout and console._stderr. An authenticated attacker can traverse the prototype chain to escape the sandbox and achieve Remote Code Execution as root. This issue has been patched in version 2.0.28."}], "source": {"advisory": "GHSA-px3p-vgh9-m57c", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-02T15:08:26.814719Z", "id": "CVE-2026-34156", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-02T15:08:38.165Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34156", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-02T15:08:26.814719Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-02T15:08:32.762Z"}}], "cna": {"title": "NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node", "source": {"advisory": "GHSA-px3p-vgh9-m57c", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 10, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "nocobase", "product": "nocobase", "versions": [{"status": "affected", "version": "< 2.0.28"}]}], "references": [{"url": "https://github.com/nocobase/nocobase/security/advisories/GHSA-px3p-vgh9-m57c", "name": "https://github.com/nocobase/nocobase/security/advisories/GHSA-px3p-vgh9-m57c", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/nocobase/nocobase/pull/8967", "name": "https://github.com/nocobase/nocobase/pull/8967", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nocobase/nocobase/releases/tag/v2.0.28", "name": "https://github.com/nocobase/nocobase/releases/tag/v2.0.28", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.28, NocoBase's Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allowlist (controlled by WORKFLOW_SCRIPT_MODULES env var). However, the console object passed into the sandbox context exposes host-realm WritableWorkerStdio stream objects via console._stdout and console._stderr. An authenticated attacker can traverse the prototype chain to escape the sandbox and achieve Remote Code Execution as root. This issue has been patched in version 2.0.28."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-913", "description": "CWE-913: Improper Control of Dynamically-Managed Code Resources"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-31T13:33:11.325Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34156", "state": "PUBLISHED", "dateUpdated": "2026-04-02T15:08:38.165Z", "dateReserved": "2026-03-25T20:12:04.196Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-31T13:33:11.325Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "nocobase", "vendor": "nocobase", "versions": [{"status": "affected", "version": "< 2.0.28"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nocobase:nocobase:*:*:*:*:*:*:*:*", "matchCriteriaId": "2F4BBE86-4C61-42A4-B11E-1AFFE76B84B9", "versionEndExcluding": "2.0.28", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.28, NocoBase's Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allowlist (controlled by WORKFLOW_SCRIPT_MODULES env var). However, the console object passed into the sandbox context exposes host-realm WritableWorkerStdio stream objects via console._stdout and console._stderr. An authenticated attacker can traverse the prototype chain to escape the sandbox and achieve Remote Code Execution as root. This issue has been patched in version 2.0.28."}, {"lang": "es", "value": "NocoBase es una plataforma no-code/low-code impulsada por IA para construir aplicaciones de negocio y soluciones empresariales. Antes de la versi\u00f3n 2.0.28, el Nodo de Script de Flujo de Trabajo de NocoBase ejecuta JavaScript proporcionado por el usuario dentro de una sandbox vm de Node.js con una lista de permitidos de 'require' personalizada (controlada por la variable de entorno WORKFLOW_SCRIPT_MODULES). Sin embargo, el objeto 'console' pasado al contexto de la sandbox expone objetos de flujo 'WritableWorkerStdio' del \u00e1mbito del host a trav\u00e9s de 'console._stdout' y 'console._stderr'. Un atacante autenticado puede recorrer la cadena de prototipos para escapar de la sandbox y lograr la ejecuci\u00f3n remota de c\u00f3digo como 'root'. Este problema ha sido parcheado en la versi\u00f3n 2.0.28."}], "id": "CVE-2026-34156", "lastModified": "2026-07-24T22:10:00.140", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34156", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-02T15:08:26.814719Z", "version": "2.0.3"}}]}, "published": "2026-03-31T14:16:12.170", "references": [{"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/nocobase/nocobase/pull/8967"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/nocobase/nocobase/releases/tag/v2.0.28"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/nocobase/nocobase/security/advisories/GHSA-px3p-vgh9-m57c"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-913"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.0.28)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "nocobase", "source": "cna", "vendor": "nocobase"}, "product": "nocobase", "vendor": "nocobase"}], "created": "2026-03-31T19:54:44.351935+00:00", "updated": "2026-10-25T18:15:15.096775+00:00", "vendors": ["nocobase", "nocobase$PRODUCT$nocobase"]}