NocoBase Critical Alert: Sandbox Escape Grants Attackers Root Access

A critical vulnerability (CVE-2026-34156, CVSS 10.0) in NocoBase’s Workflow Script Node allows authenticated users to escape the Node.js vm sandbox by exposing the host console object, enabling prototype chain traversal to the host Function constructor. Successful exploitation yields root RCE in containers, theft of environment credentials, arbitrary file system access via require('fs'), and potential lateral movement; NocoBase released a patch (2.0.28) and the report recommends replacing vm with isolated-vm, proxying console objects, and running containers non-root.