CVE-2026-6224 nocobase CVE debrief

Who should care

Defenders responsible for nocobase plugin-workflow-javascript deployments should assess exposure and prioritize verification and mitigation. This includes reviewing the current version of the plugin, identifying potentially affected systems, and applying patches or mitigations as recommended. Security teams and vulnerability management teams should also be aware of the potential risks and take necessary actions to protect their assets.

Why it matters

A sandbox issue in nocobase plugin-workflow-javascript up to 2.0.23 can be exploited remotely, and the exploit has been released to the public. Defenders should prioritize verification and mitigation.

• Verify the version of nocobase plugin-workflow-javascript and apply patches or mitigations.
• Monitor for potential exploitation attempts.
• Implement compensating controls to mitigate the vulnerability.

Technical summary

The vulnerability affects the function createSafeConsole of the file packages/plugins/@nocobase/plugin-workflow-javascript/src/server/Vm.js in nocobase plugin-workflow-javascript up to 2.0.23. The issue can be exploited remotely, and the exploit has been released to the public. This sandbox issue can lead to potential security risks if not addressed. Defenders should prioritize verifying the version of nocobase plugin-workflow-javascript and applying patches or mitigations as recommended by the vendor to mitigate potential impacts.

Defensive priority

Defenders should prioritize verifying the version of nocobase plugin-workflow-javascript and applying patches or mitigations as recommended by the vendor.

Recommended defensive actions

• Verify the version of nocobase plugin-workflow-javascript and apply patches or mitigations as recommended by the vendor.
• Monitor for potential exploitation attempts.
• Implement compensating controls to mitigate the vulnerability.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide information about the vulnerability, but the vendor did not respond to the disclosure. The exploit has been released to the public, but there is no information on its usage in attacks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.