Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:npm/%40nocobase/plugin-workflow-javascript@2.0.23
purl pkg:npm/%40nocobase/plugin-workflow-javascript@2.0.23
Next non-vulnerable version 2.0.28
Latest non-vulnerable version 2.0.28
Risk 10.0
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-bpqh-1b2j-b3ct
Aliases:
CVE-2026-34156
GHSA-px3p-vgh9-m57c
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.28, NocoBase's Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allowlist (controlled by WORKFLOW_SCRIPT_MODULES env var). However, the console object passed into the sandbox context exposes host-realm WritableWorkerStdio stream objects via console._stdout and console._stderr. An authenticated attacker can traverse the prototype chain to escape the sandbox and achieve Remote Code Execution as root. This issue has been patched in version 2.0.28.
2.0.28
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-12T21:43:27.713959+00:00 GitLab Importer Affected by VCID-bpqh-1b2j-b3ct https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/@nocobase/plugin-workflow-javascript/CVE-2026-34156.yml 38.6.0