CVE-2026-34156 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-34156 requires immediate attention.

· 3 min read

```html

Executive Summary

A critical vulnerability (CVE-2026-34156) has been identified in the NocoBase Workflow Script Node, allowing authenticated attackers to escape the JavaScript VM sandbox and achieve Remote Code Execution (RCE) as root. This flaw can lead to severe consequences, including database credential theft and arbitrary file manipulation. Solo developers and small teams using the affected npm package are strongly advised to take immediate action.

Immediate Action

  • Immediately assess your use of the @nocobase/plugin-workflow-javascript package.
  • Implement the recommended remediations below to secure your application.
  • Run your application as a non-root user in Docker to limit exposure.
  • Restrict access to the /api/flow_nodes:test endpoint to admin roles only.
  • Monitor for any unusual activity in your application logs.
  • Stay tuned for updates from NocoBase regarding a patched version.

Affected Versions

  • @nocobase/plugin-workflow-javascript@<=2.0.26 vulnerable; upgrade to 2.0.27+

Resolution Guide

To mitigate this vulnerability, follow these steps:

npm install @nocobase/plugin-workflow-javascript@2.0.27

For Docker users, ensure you are running as a non-root user:

RUN useradd -ms /bin/bash nonrootuser
USER nonrootuser

To harden your configuration, avoid passing the host console object into the sandbox:

const safeConsole = { log: () => {}, error: () => {} };

Detection & Verification

To check if your version is vulnerable, run:

npm list @nocobase/plugin-workflow-javascript

To verify the fix, ensure you have upgraded to a non-vulnerable version:

npm list @nocobase/plugin-workflow-javascript

Risk and Impact

The exploitation of CVE-2026-34156 can lead to Remote Code Execution as root within Docker containers, allowing attackers to steal sensitive database credentials and execute arbitrary commands. The risk extends to lateral movement within your network and potential data loss, making immediate remediation critical.

```

Keep reading