External risk intelligence

NocoBase Workflow Script Node Sandbox Escape Leading to RCE

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-34156

NocoBase is a web-based no-code/low-code platform designed for building enterprise applications and business solutions. As a platform intended to host web applications and business services, it is commonly deployed as an internet-facing or externally accessible web application.

Remote Code Execution

Nocobase

before 2.0.28

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in NocoBase, an AI-powered platform used for developing business applications. The issue allows an authenticated attacker to execute arbitrary code on the server, potentially leading to a full system compromise.

Code execution vulnerability found in NocoBase.
Could allow unauthorized control of business applications.
Verify if NocoBase is deployed within the organization.

Attack Path

How an attacker could exploit the issue

An authenticated attacker can exploit this vulnerability by chaining prototype pollution to escape the Node.js sandbox in NocoBase's Workflow Script Node. This escape allows the attacker to achieve Remote Code Execution with root privileges.

Requires authenticated access.
Triggered via user-supplied JavaScript.
Leads to root-level code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an authenticated attacker to execute arbitrary code on the server when the Workflow Script Node is utilized. The exploit involves escaping a Node.js sandbox by manipulating the `console` object to access host-realm objects. When supported by the advisory, this could lead to a compromise of the server's operating system.

Server-side code execution.
Exploits sandbox escape via `console` object.
Remote code execution as root.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and platform teams are likely responsible for addressing this critical vulnerability in NocoBase. The first step is to identify all NocoBase instances, confirm their reachability and business criticality, and then establish ownership. Remediation planning should then follow based on this risk assessment, potentially involving vendor coordination and scheduling within maintenance windows.

Confirm application and platform ownership.
Verify NocoBase instance reachability.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is NocoBase?

NocoBase is an AI-powered no-code and low-code development platform. Organizations use it to build custom business applications and enterprise-grade software solutions without needing to write extensive traditional code, often deploying it as a central hub for managing business processes and data services.

What does CWE-913 mean for CVE-2026-34156?

CWE-913 refers to improper control of generation of code, often involving the execution of untrusted code in a dangerous environment. In this specific case, NocoBase attempts to run user-supplied JavaScript in a isolated sandbox, but the implementation fails to fully contain the code. This allows an attacker to break out of that isolated environment to interact with the underlying server.

How is this NocoBase sandbox escape triggered?

The vulnerability is triggered through the Workflow Script Node when an attacker provides malicious JavaScript. By manipulating the console object exposed to that script, the attacker can access host-realm objects and traverse the prototype chain. Notably, this does not occur if the Workflow Script Node feature is disabled or if the attacker cannot submit their own scripts to the workflow engine.

Is my NocoBase instance at risk?

According to Halo Surface Signal, NocoBase is typically deployed as a web-based platform for business services, making it frequently internet-facing. If your instance is accessible from the internet, it is at higher risk. Even if internal, any authenticated user with access to the Workflow Script Node could potentially exploit this to gain control over the server.

What should I do to fix CVE-2026-34156?

The primary response is to update your software to version 2.0.28 or later, where this vulnerability has been patched. First, locate all NocoBase deployments within your environment, confirm which ones are currently running versions prior to 2.0.28, and prioritize these for patching during your next maintenance window.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.