CVE-2026-6224

BRIEFING NOTE - CVE-2026-6224 A sandbox bypass vulnerability has been identified in NocoDB's plugin-workflow-javascript component, specifically within the createSafeConsole function of the Vm.js file. The flaw affects all versions up to and including 2.0.23, allowing attackers to escape the intended sandbox restrictions through code manipulation. The vulnerability carries a CVSS score of 7.3 (HIGH) with a network-based attack vector requiring no authentication or user interaction. The attack presents low complexity and could result in partial compromise of confidentiality, integrity, and availability. The EPSS score of 0.0005 indicates relatively low predicted exploitation probability across the vulnerability landscape. The exploit code has been publicly released and is available for potential attackers. However, the vulnerability currently shows no evidence of active exploitation in the wild, with no entries on known exploited vulnerabilities lists. The vendor was notified early in the disclosure process but has not provided a response or patch, leaving affected organizations without an official remediation path and increasing reliance on defensive measures or version upgrades.