EUVD-2026-81592

vm2 before 3.11.7 affected versions = 3.11.6 does not enforce the VM timeout option on code executed outside the synchronous VMrun call. The timeout only wraps the single call to runScript via doWithTimeout in lib/vm.js, and FinalizationRegistry and WeakRef are exposed to sandboxed code unmodifie...

PT-2026-94314

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.11.7 Description The software fails to enforce the timeout option for code executed outside the synchronous run function. This occurs because the timeout only wraps the runScript call via doWithTimeout in the lib/vm.js...

CVE-2026-6224

A security flaw has been discovered in nocobase plugin-workflow-javascript up to 2.0.23. This issue affects the function createSafeConsole of the file packages/plugins/@nocobase/plugin-workflow-javascript/src/server/Vm.js. Performing a manipulation results in sandbox issue. The attack can be...

CVE-2026-6224: Undefined Security Weakness

A security flaw has been discovered in nocobase plugin-workflow-javascript up to 2.0.23. This issue affects the function createSafeConsole of the file packages/plugins/@nocobase/plugin-workflow-javascript/src/server/Vm.js. Performing a manipulation results in sandbox issue. The attack can be...

Nocobase 安全漏洞

Nocobase is an open-source low-code platform developed by NocoBase. Versions of Nocobase 2.0.23 and earlier contained security vulnerabilities. These vulnerabilities were caused by improper use of the createSafeConsole function in the...