{"api_version":"1","generated_at":"2026-04-14T01:59:52+00:00","cve":"CVE-2026-6224","urls":{"html":"https://cve.report/CVE-2026-6224","api":"https://cve.report/api/cve/CVE-2026-6224.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-6224","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-6224"},"summary":{"title":"nocobase plugin-workflow-javascript Vm.js createSafeConsole sandbox","description":"A security flaw has been discovered in nocobase plugin-workflow-javascript up to 2.0.23. This issue affects the function createSafeConsole of the file packages/plugins/@nocobase/plugin-workflow-javascript/src/server/Vm.js. Performing a manipulation results in sandbox issue. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","state":"PUBLISHED","assigner":"VulDB","published_at":"2026-04-13 22:16:30","updated_at":"2026-04-13 22:16:30"},"problem_types":["CWE-264","CWE-265","CWE-265 Sandbox Issue","CWE-264 Improper Access Controls"],"metrics":[{"version":"4.0","source":"cna@vuldb.com","type":"Secondary","score":"6.9","severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","data":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}},{"version":"4.0","source":"CNA","type":"DECLARED","score":"6.9","severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","data":{"baseScore":6.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","version":"4.0"}},{"version":"3.1","source":"cna@vuldb.com","type":"Primary","score":"7.3","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.3","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","data":{"baseScore":7.3,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","version":"3.1"}},{"version":"3.0","source":"CNA","type":"DECLARED","score":"7.3","severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","data":{"baseScore":7.3,"baseSeverity":"HIGH","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","version":"3.0"}},{"version":"2.0","source":"cna@vuldb.com","type":"Secondary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}},{"version":"2.0","source":"CNA","type":"DECLARED","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR","data":{"baseScore":7.5,"vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR","version":"2.0"}}],"references":[{"url":"https://vuldb.com/vuln/357142/cti","name":"https://vuldb.com/vuln/357142/cti","refsource":"cna@vuldb.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://vuldb.com/submit/785881","name":"https://vuldb.com/submit/785881","refsource":"cna@vuldb.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://vuldb.com/vuln/357142","name":"https://vuldb.com/vuln/357142","refsource":"cna@vuldb.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/Pai-777/ai-cve/blob/main/docs/cve-drafts/nocobase-workflow-javascript-sandbox-escape.en.md","name":"https://github.com/Pai-777/ai-cve/blob/main/docs/cve-drafts/nocobase-workflow-javascript-sandbox-escape.en.md","refsource":"cna@vuldb.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6224","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6224","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"nocobase","product":"plugin-workflow-javascript","version":"affected 2.0.0","platforms":[]},{"source":"CNA","vendor":"nocobase","product":"plugin-workflow-javascript","version":"affected 2.0.1","platforms":[]},{"source":"CNA","vendor":"nocobase","product":"plugin-workflow-javascript","version":"affected 2.0.2","platforms":[]},{"source":"CNA","vendor":"nocobase","product":"plugin-workflow-javascript","version":"affected 2.0.3","platforms":[]},{"source":"CNA","vendor":"nocobase","product":"plugin-workflow-javascript","version":"affected 2.0.4","platforms":[]},{"source":"CNA","vendor":"nocobase","product":"plugin-workflow-javascript","version":"affected 2.0.5","platforms":[]},{"source":"CNA","vendor":"nocobase","product":"plugin-workflow-javascript","version":"affected 2.0.6","platforms":[]},{"source":"CNA","vendor":"nocobase","product":"plugin-workflow-javascript","version":"affected 2.0.7","platforms":[]},{"source":"CNA","vendor":"nocobase","product":"plugin-workflow-javascript","version":"affected 2.0.8","platforms":[]},{"source":"CNA","vendor":"nocobase","product":"plugin-workflow-javascript","version":"affected 2.0.9","platforms":[]},{"source":"CNA","vendor":"nocobase","product":"plugin-workflow-javascript","version":"affected 2.0.10","platforms":[]},{"source":"CNA","vendor":"nocobase","product":"plugin-workflow-javascript","version":"affected 2.0.11","platforms":[]},{"source":"CNA","vendor":"nocobase","product":"plugin-workflow-javascript","version":"affected 2.0.12","platforms":[]},{"source":"CNA","vendor":"nocobase","product":"plugin-workflow-javascript","version":"affected 2.0.13","platforms":[]},{"source":"CNA","vendor":"nocobase","product":"plugin-workflow-javascript","version":"affected 2.0.14","platforms":[]},{"source":"CNA","vendor":"nocobase","product":"plugin-workflow-javascript","version":"affected 2.0.15","platforms":[]},{"source":"CNA","vendor":"nocobase","product":"plugin-workflow-javascript","version":"affected 2.0.16","platforms":[]},{"source":"CNA","vendor":"nocobase","product":"plugin-workflow-javascript","version":"affected 2.0.17","platforms":[]},{"source":"CNA","vendor":"nocobase","product":"plugin-workflow-javascript","version":"affected 2.0.18","platforms":[]},{"source":"CNA","vendor":"nocobase","product":"plugin-workflow-javascript","version":"affected 2.0.19","platforms":[]},{"source":"CNA","vendor":"nocobase","product":"plugin-workflow-javascript","version":"affected 2.0.20","platforms":[]},{"source":"CNA","vendor":"nocobase","product":"plugin-workflow-javascript","version":"affected 2.0.21","platforms":[]},{"source":"CNA","vendor":"nocobase","product":"plugin-workflow-javascript","version":"affected 2.0.22","platforms":[]},{"source":"CNA","vendor":"nocobase","product":"plugin-workflow-javascript","version":"affected 2.0.23","platforms":[]}],"timeline":[{"source":"CNA","time":"2026-04-13T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"source":"CNA","time":"2026-04-13T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"source":"CNA","time":"2026-04-13T15:54:30.000Z","lang":"en","value":"VulDB entry last update"}],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Paaai (VulDB User)","lang":"en"},{"source":"CNA","value":"VulDB CNA Team","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"product":"plugin-workflow-javascript","vendor":"nocobase","versions":[{"status":"affected","version":"2.0.0"},{"status":"affected","version":"2.0.1"},{"status":"affected","version":"2.0.2"},{"status":"affected","version":"2.0.3"},{"status":"affected","version":"2.0.4"},{"status":"affected","version":"2.0.5"},{"status":"affected","version":"2.0.6"},{"status":"affected","version":"2.0.7"},{"status":"affected","version":"2.0.8"},{"status":"affected","version":"2.0.9"},{"status":"affected","version":"2.0.10"},{"status":"affected","version":"2.0.11"},{"status":"affected","version":"2.0.12"},{"status":"affected","version":"2.0.13"},{"status":"affected","version":"2.0.14"},{"status":"affected","version":"2.0.15"},{"status":"affected","version":"2.0.16"},{"status":"affected","version":"2.0.17"},{"status":"affected","version":"2.0.18"},{"status":"affected","version":"2.0.19"},{"status":"affected","version":"2.0.20"},{"status":"affected","version":"2.0.21"},{"status":"affected","version":"2.0.22"},{"status":"affected","version":"2.0.23"}]}],"credits":[{"lang":"en","type":"reporter","value":"Paaai (VulDB User)"},{"lang":"en","type":"coordinator","value":"VulDB CNA Team"}],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in nocobase plugin-workflow-javascript up to 2.0.23. This issue affects the function createSafeConsole of the file packages/plugins/@nocobase/plugin-workflow-javascript/src/server/Vm.js. Performing a manipulation results in sandbox issue. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}],"metrics":[{"cvssV4_0":{"baseScore":6.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","version":"4.0"}},{"cvssV3_1":{"baseScore":7.3,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","version":"3.1"}},{"cvssV3_0":{"baseScore":7.3,"baseSeverity":"HIGH","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","version":"3.0"}},{"cvssV2_0":{"baseScore":7.5,"vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR","version":"2.0"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-265","description":"Sandbox Issue","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-264","description":"Improper Access Controls","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-04-13T21:15:11.914Z","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB"},"references":[{"name":"VDB-357142 | nocobase plugin-workflow-javascript Vm.js createSafeConsole sandbox","tags":["vdb-entry","technical-description"],"url":"https://vuldb.com/vuln/357142"},{"name":"VDB-357142 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"],"url":"https://vuldb.com/vuln/357142/cti"},{"name":"Submit #785881 | NocoBase 2.0.23 Sandbox Issue","tags":["third-party-advisory"],"url":"https://vuldb.com/submit/785881"},{"tags":["exploit"],"url":"https://github.com/Pai-777/ai-cve/blob/main/docs/cve-drafts/nocobase-workflow-javascript-sandbox-escape.en.md"}],"timeline":[{"lang":"en","time":"2026-04-13T00:00:00.000Z","value":"Advisory disclosed"},{"lang":"en","time":"2026-04-13T02:00:00.000Z","value":"VulDB entry created"},{"lang":"en","time":"2026-04-13T15:54:30.000Z","value":"VulDB entry last update"}],"title":"nocobase plugin-workflow-javascript Vm.js createSafeConsole sandbox"}},"cveMetadata":{"assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","assignerShortName":"VulDB","cveId":"CVE-2026-6224","datePublished":"2026-04-13T21:15:11.914Z","dateReserved":"2026-04-13T13:49:25.263Z","dateUpdated":"2026-04-13T21:15:11.914Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-04-13 22:16:30","lastModifiedDate":"2026-04-13 22:16:30","problem_types":["CWE-264","CWE-265","CWE-265 Sandbox Issue","CWE-264 Improper Access Controls"],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"6224","Ordinal":"1","Title":"nocobase plugin-workflow-javascript Vm.js createSafeConsole sand","CVE":"CVE-2026-6224","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"6224","Ordinal":"1","NoteData":"A security flaw has been discovered in nocobase plugin-workflow-javascript up to 2.0.23. This issue affects the function createSafeConsole of the file packages/plugins/@nocobase/plugin-workflow-javascript/src/server/Vm.js. Performing a manipulation results in sandbox issue. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","Type":"Description","Title":"nocobase plugin-workflow-javascript Vm.js createSafeConsole sand"}]}}}