The vulnerability originates from the Workflow Script Node in NocoBase, a low‑code platform. The node executes user‑supplied JavaScript in a Node.js VM that deliberately limits module access with a custom require allowlist. However, the sandbox receives a console object that contains writable stream references (console._stdout, console._stderr). An attacker who has authenticated access can navigate the prototype chain of this object, reach those host‑realm WritableWorkerStdio streams, and thereby escape the sandbox. The escape grants the attacker unrestricted code execution with root privileges, leading to a complete compromise of the underlying host system.

NocoBase deployments running any version older than 2.0.28 are affected. The flaw is present in the Workflow Script Node component of the platform. Users with authenticated accounts that can create or run workflow scripts are required to exploit the issue. All installations of NocoBase, regardless of hosting environment, that have not applied the 2.0.28 update remain vulnerable.

The issue carries a CVSS score of 10.0, indicating maximum severity. No EPSS score is publicly available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires valid authentication to the application and the ability to trigger a workflow that includes a script node. Once the sandbox escape is achieved, the attacker gains root level access to the host machine, making the risk extreme for any exposed deployment.