CVE-2026-6224
Published: 13 April 2026
Summary
CVE-2026-6224 is a medium-severity an unspecified weakness vulnerability. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-6224 is a sandbox escape vulnerability affecting the nocobase plugin-workflow-javascript up to version 2.0.23. The flaw resides in the createSafeConsole function within the file packages/plugins/@nocobase/plugin-workflow-javascript/src/server/Vm.js. It allows manipulation that bypasses sandbox restrictions, as classified under CWE-264 (Permissions, Privileges, and Access Control) and CWE-265 (Incorrect Permission Assignment for Critical Resource).
The vulnerability is remotely exploitable with low complexity, requiring no privileges or user interaction, per its CVSS 3.1 score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Unauthenticated remote attackers can trigger the sandbox issue, potentially gaining limited access to confidentiality, integrity, and availability impacts.
No patches or mitigations are detailed in the available disclosure, and the vendor was contacted early but provided no response. Practitioners should consult the references for additional analysis, including VulDB entries (vuldb.com/vuln/357142) and a GitHub draft documenting the sandbox escape.
An exploit for this issue has been publicly released and may be leveraged in attacks.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-22122
Vulnerability details
A security flaw has been discovered in nocobase plugin-workflow-javascript up to 2.0.23. This issue affects the function createSafeConsole of the file packages/plugins/@nocobase/plugin-workflow-javascript/src/server/Vm.js. Performing a manipulation results in sandbox issue. The attack can be initiated remotely. The exploit has been released…
more
to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated sandbox escape in public-facing JS workflow plugin directly enables T1190 (Exploit Public-Facing Application) and facilitates T1059.007 (JavaScript) via bypassed restrictions.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely remediation of the sandbox escape flaw in nocobase plugin-workflow-javascript, preventing remote exploitation of CVE-2026-6224.
Scans for and identifies CVE-2026-6224 in deployed systems, enabling proactive patching or mitigation before attacker exploitation.
Restricts or prohibits use of the vulnerable nocobase plugin-workflow-javascript software, reducing exposure to unauthenticated remote sandbox escape attacks.