Threats affecting pkg:npm/plugin-workflow-javascript

CVE-2026-6224 is a medium severity vulnerability in the nocobase plugin-workflow-javascript versions up to 2.0.23. It involves a sandbox issue in the createSafeConsole function within the Vm.js file, which can be exploited remotely without authentication. Although the exploit code has been publicly released, the vendor has not responded or provided any patch or mitigation guidance. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a moderate risk. No official fix or temporary workaround is currently available, and the patch status remains unconfirmed.