CVE-2026-34156 — AI Deep Analysis Summary

Q: What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: NocoBase Workflow Script Node allows **Remote Code Execution (RCE)**. 📉 **Consequences**: Attackers escape the `vm` sandbox via prototype pollution, gaining full control over the host system.

Q: Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: **CWE-913** (Improper Control of Dynamically-Managed Code Resources). The `console` object in the Node.js `vm` sandbox leaks `WritableWorkerStdio` streams, enabling prototype chain traversal. 🧬

Q: Who is affected? (Versions/Components)

📦 **Affected**: **NocoBase** (Low-code platform). 📅 **Versions**: All versions **before 2.0.28**. ✅ **Fixed**: Version 2.0.28+.

Q: What can hackers do? (Privileges/Data)

💀 **Attacker Capabilities**: Achieves **RCE as root**. 🌐 Can execute arbitrary commands, access sensitive data, and pivot to other internal systems. Full system compromise.

Q: Is exploitation threshold high? (Auth/Config)

🔑 **Threshold**: **Medium**. ⚠️ Requires **Authenticated** access. 🚫 No UI interaction needed (UI:N). Low complexity (AC:L). Network accessible (AV:N).

Q: Is there a public Exp? (PoC/Wild Exploitation)

🔓 **Exploit Status**: **Yes**. Public PoC exists via Nuclei templates. 📂 GitHub Advisory (GHSA-px3p-vgh9-m57c) details the `console._stdout.constructor` exploitation path.

Q: How to self-check? (Features/Scanning)

🔍 **Self-Check**: 1. Check NocoBase version (< 2.0.28). 2. Scan for Workflow Script Nodes. 3. Use Nuclei template `CVE-2026-34156.yaml` for automated detection. 🛠️

Q: Is it fixed officially? (Patch/Mitigation)

🩹 **Official Fix**: **Yes**. Upgrade to **NocoBase v2.0.28** or later. 📥 Pull Request #8967 addresses the sandbox leakage issue.

Q: What if no patch? (Workaround)

🚧 **No Patch Workaround**: 1. Restrict access to Workflow Script Nodes. 2. Disable unnecessary workflow scripts. 3. Isolate the NocoBase instance from critical networks. 🛑

Q: Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **CRITICAL**. 🚨 CVSS Score: **9.8** (High). Immediate patching required due to RCE potential and low exploitation barrier for authenticated users.

Updated May 06, 2026 CVSS 10.0 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: NocoBase Workflow Script Node allows **Remote Code Execution (RCE)**. 📉 **Consequences**: Attackers escape the `vm` sandbox via prototype pollution, gaining full control over the host system.

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: **CWE-913** (Improper Control of Dynamically-Managed Code Resources). The `console` object in the Node.js `vm` sandbox leaks `WritableWorkerStdio` streams, enabling prototype chain traversal. 🧬

Q3Who is affected? (Versions/Components)

📦 **Affected**: **NocoBase** (Low-code platform). 📅 **Versions**: All versions **before 2.0.28**. ✅ **Fixed**: Version 2.0.28+.

Q4What can hackers do? (Privileges/Data)

💀 **Attacker Capabilities**: Achieves **RCE as root**. 🌐 Can execute arbitrary commands, access sensitive data, and pivot to other internal systems. Full system compromise.

Q5Is exploitation threshold high? (Auth/Config)

🔑 **Threshold**: **Medium**. ⚠️ Requires **Authenticated** access. 🚫 No UI interaction needed (UI:N). Low complexity (AC:L). Network accessible (AV:N).

Q6Is there a public Exp? (PoC/Wild Exploitation)

🔓 **Exploit Status**: **Yes**. Public PoC exists via Nuclei templates. 📂 GitHub Advisory (GHSA-px3p-vgh9-m57c) details the `console._stdout.constructor` exploitation path.

Q7How to self-check? (Features/Scanning)

🔍 **Self-Check**: 1. Check NocoBase version (< 2.0.28). 2. Scan for Workflow Script Nodes. 3. Use Nuclei template `CVE-2026-34156.yaml` for automated detection. 🛠️

Q8Is it fixed officially? (Patch/Mitigation)

🩹 **Official Fix**: **Yes**. Upgrade to **NocoBase v2.0.28** or later. 📥 Pull Request #8967 addresses the sandbox leakage issue.

Q9What if no patch? (Workaround)

🚧 **No Patch Workaround**: 1. Restrict access to Workflow Script Nodes. 2. Disable unnecessary workflow scripts. 3. Isolate the NocoBase instance from critical networks. 🛑

Q10Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **CRITICAL**. 🚨 CVSS Score: **9.8** (High). Immediate patching required due to RCE potential and low exploitation barrier for authenticated users.

Continue exploring

Vulnerability detail Full AI analysis (login) nocobase CWE-913