This vulnerability exists in the createSafeConsole function of the nocobase plugin-workflow-javascript package (versions up to 2.0.23). It causes a sandbox escape or bypass issue, allowing remote attackers to manipulate the sandbox environment. The vulnerability is remotely exploitable without privileges or user interaction. The vendor has not issued any advisory or patch, and no remediation level is indicated. The CVSS 4.0 base score is 6.9, reflecting medium severity with network attack vector and low complexity.

Successful exploitation could allow an attacker to bypass sandbox restrictions in the affected plugin, potentially leading to unauthorized code execution or other impacts within the context of the plugin. The vulnerability is remotely exploitable without authentication or user interaction. However, no confirmed exploits in the wild have been reported beyond the public exploit release. The lack of vendor response or patch means the risk remains unmitigated by official means.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or advisory has been released by the vendor, users should consider applying additional sandboxing or isolation controls around the plugin or avoid using affected versions until a patch is available. Monitor official nocobase channels for updates.