CVE-2026-6224 Details

A sandbox escape vulnerability has been identified in the NocoBase plugin 'workflow-javascript' versions prior to 2.0.23. The issue arises in the 'createSafeConsole' function within 'Vm.js', where the prototype chain of bound 'console' methods is not properly sanitized. This oversight allows an attacker to access the host 'Function' constructor and, subsequently, the 'process' object, breaking the intended isolation of the virtual machine environment. The vulnerability can be exploited remotely, without authentication, by users with access to the Workflow JavaScript node testing feature.

To address this vulnerability, do not pass host function objects directly into 'runInNewContext()'. Instead, replace 'console' with a message-forwarding wrapper that does not expose host functions. Additionally, block recovery paths to the 'Function.prototype.constructor' or adopt a stronger isolation design. After applying these changes, extend security tests to cover prototype-chain access to ensure the vulnerability is effectively mitigated.