The flaw in NocoBase’s Workflow Script Node lets an authenticated attacker run user‑supplied JavaScript inside a Node.js VM sandbox. Because the sandboxed code receives a console object that leaks host‑level WritableWorkerStdio streams through console._stdout and console._stderr, an attacker can traverse the prototype chain to escape the sandbox. The escape grants unrestricted execution privileges on the underlying operating system, effectively achieving remote code execution with root authority. This weakness corresponds to CWE‑913, reflecting an improper control of the execution environment.

NocoBase is the affected product. All releases before v2.0.28 are vulnerable. The patch, released in v2.0.28, addresses the issue.

The vulnerability scores a maximum CVSS score of 10, indicating critical severity. An EPSS score of 9% suggests a moderate probability of exploitation in the wild. The issue is not listed in CISA’s KEV catalog, implying no known widespread exploitation yet. The exploit requires the attacker to have authenticated access to the NocoBase instance, enabling the creation or modification of workflow scripts. Attackers can embed JavaScript that traverses the prototype chain via console._stdout, escapes the VM boundary, and runs arbitrary commands as the host process user. Since the escape grants root‑level permissions, any compromised server can be fully taken over.