PoC---CVE-2023-26482-RCE-LAB-Nextcloud

Next cloud 概念验证与分析 安全声明 本仓库复现了一个已公开披露并修复的漏洞，在受控的 Docker 实验环境中用于教育和研究目的。 该环境故意设计为存在漏洞，必须只在隔离的测试环境中部署。禁止未经明确授权尝试利用任何系统。 本项目旨在展示漏洞分析、利用流程及缓解策略。 本实验复现了 CVE-2023-26482 ，一个 Nextcloud Server 中的缺失范围验证漏洞，允许经过身份验证的用户创建恶意工作流，若安装了“工作流脚本”应用，则可能导致远程代码执行RCE。 前提条件 Docker 和 Docker Compose Python 3 requests 库 安装 1...

CVE-2026-34156

🚨 CVE-2026-34156 - Kritische Sandbox-Escape in NocoBase Nicht authentifiziert / Niedrige Berechtigungen → Root Remote Code Execution in NocoBase 📌 Übersicht CVE-2026-34156 ist eine kritische Sandbox-Escape-Sicherheitslücke in NocoBase einer Open-Source-No-Code/Low-Code-Plattform. Ein Angreifer, d...

CVE-2026-61438

PraisonAI before 4.6.78 contains a remote code execution vulnerability in JobWorkflowExecutor.execinlinepython due to insufficient AST validation of workflow script steps. Attackers can create malicious YAML workflow files with import os statements followed by os.system calls that bypass sandbox...

📄 NocoBase 2.0.27 Sandbox Escape / Remote Code Execution

NocoBase versions 2.0.27 and below suffer from a sandbox escape vulnerability in the Workflow Script Node. The console object passed into the Node.js vm sandbox context exposes host-realm WritableWorkerStdio stream objects via console.stdout. An authenticated attacker can traverse the prototype...

CVE-2026-34156

NocoBase exposes a sandbox escape in the Workflow Script Node: an attacker can traverse the sandbox through the host console object (console._stdout/console._stderr) prototype chain to reach the Function constructor, access process, require child_process, and achieve Remote Code Execution as root...

CVE-2026-34156 NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.28, NocoBase's Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allowlist controlled by WORKFLOWSCRIPTMODUL...

CVE-2026-34156 NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.28, NocoBase's Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allowlist controlled by WORKFLOWSCRIPTMODUL...

EUVD-2026-8645

LiveCode is an open-source, client-side code playground. Prior to commit e151c64c2bd80d2d53ac1333f1df9429fe6a1a11, LiveCode's i18n-update-pull GitHub Actions workflow is vulnerable to JavaScript injection. The title of the Pull Request associated with the triggering issue comment is interpolated...

📄 Nextcloud Workflows Remote Code Execution

This Metasploit module adds workflows as an authenticated user which can only be created by administrators by design. If the app "Nextcloud Workflow Script" is installed it is possible to generate a workflow that executes commands. This module requires Metasploit: https://metasploit.com/download...