EUVD-2026-22122
GHSA-f6qv-f2mh-m4wj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Workflow JavaScript authoring requires at minimum an authenticated low-privilege session; scope changes to host runtime justify S:C, with partial C and I reflecting information disclosure and limited write capability.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
A security flaw has been discovered in nocobase plugin-workflow-javascript up to 2.0.23. This issue affects the function createSafeConsole of the file packages/plugins/@nocobase/plugin-workflow-javascript/src/server/Vm.js. Performing a manipulation results in sandbox issue. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Sandbox escape in NocoBase's plugin-workflow-javascript (all 2.0.x releases through 2.0.23) originates from a defective createSafeConsole implementation in the server-side Vm.js file, enabling remote attackers to break out of the JavaScript VM execution boundary and interact with the host Node.js process. A public proof-of-concept exploit has been released and documented on GitHub, and SSVC analysis classifies the attack vector as automatable. Despite the available PoC, EPSS probability sits at just 0.04% (12th percentile) and the vulnerability is not listed in CISA KEV, indicating limited observed exploitation activity at time of analysis.
Technical ContextAI
NocoBase is an open-source no-code/low-code application builder; its plugin-workflow-javascript plugin extends the workflow engine by allowing users to author JavaScript-based workflow nodes that execute server-side. The createSafeConsole function in packages/plugins/@nocobase/plugin-workflow-javascript/src/server/Vm.js is responsible for providing a restricted console interface inside a Node.js vm-module sandbox. CWE-265 (Privilege Issues) identifies the root cause class as inadequate separation of privilege between the sandboxed execution context and the ambient host runtime. Node.js vm contexts are well-known to be insufficiently isolated - techniques such as constructor chain traversal (this.constructor.constructor) or prototype pollution can trivially escape them, and createSafeConsole likely fails to neutralize one or more such vectors. The CPE cpe:2.3:a:nocobase:plugin-workflow-javascript:*:*:*:*:*:*:*:* confirms that the entire published 2.0.x series is within scope.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor did not respond to the coordinated disclosure process. The most effective compensating control is to disable or remove the plugin-workflow-javascript plugin entirely if JavaScript-based workflow nodes are not operationally required; this eliminates the attack surface completely. If the plugin must remain active, restrict workflow creation and editing capabilities exclusively to highly trusted administrative accounts and enforce network-layer controls to prevent untrusted users or external networks from reaching the NocoBase interface. Review and monitor server-side logs for anomalous file-system access, unexpected environment variable reads, or unusual outbound network connections originating from workflow execution processes. The public PoC at https://github.com/Pai-777/ai-cve/blob/main/docs/cve-drafts/nocobase-workflow-javascript-sandbox-escape.en.md documents the specific bypass technique and should be reviewed to develop targeted detection signatures. Until an upstream patched release above 2.0.23 is available and vendor-confirmed, no safe upgrade path exists.
Same weakness CWE-265 – Privilege Issues
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today