CVE-2026-6224

HighCVSS 7.3/10Last modified Oct 26, 2026

Description

A security flaw has been discovered in nocobase plugin-workflow-javascript up to 2.0.23. This issue affects the function createSafeConsole of the file packages/plugins/@nocobase/plugin-workflow-javascript/src/server/Vm.js. Performing a manipulation results in sandbox issue. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-264 CWE-265

Affected software

Vendor	Product	Versions
nocobase	plugin-workflow-javascript	2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; 2.0.6; 2.0.7; 2.0.8; 2.0.9; 2.0.10; 2.0.11; 2.0.12; 2.0.13; 2.0.14; 2.0.15; 2.0.16; 2.0.17; 2.0.18; 2.0.19

References

Timeline

Published: Apr 13, 2026
Last modified: Oct 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-622407.4CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one-shot DNS resolution CVE-2026-622419.1clawvet self-hosted API server (apps/api) before 0.7.5 hard-codes a fallback JWT secret ('clawvet-dev-secret-change-me') in auth.ts and ship CVE-2026-622428.6Spring Boot Admin Server before 4.1.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to register CVE-2026-622437.5Netty (io.netty:netty-handler) versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verifi CVE-2026-622468.5Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, Kamaji derives a TenantControlPlane datastore schema, datab CVE-2026-622476.5Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not corre CVE-2026-622494.3Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, an authenticated CVE-2026-62256.5The Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress is vulnerable to time-based blind SQL Inj CVE-2026-622505.5LibreDWG is a free C library to read and write DWG files. Prior to 0.14.8413, a crafted pre-R13 DWG can make `decode_preR13_entities()` in `CVE-2026-622518.1Homer is open source telecom observability software. Prior to version 11.0.283, the `V4StatisticsQuery` handler passes the user-supplied `ra CVE-2026-622529.8Homer is open source telecom observability software. Prior to version 11.0.283, on every fresh Homer deployment using internal authenticatio CVE-2026-622539.8Homer is open source telecom observability software. Prior to version 11.0.283, both JWT middleware functions (`JWTMiddleware` and `JWTMiddl