ENDOR-VUL-2026-16044

Description: compileTemplate() regex-matches {{ t('key', {options}) }} and evaluates the options block through new Function('$root', 'with($root) { return (...) }')({}). The scope object passed in is empty, so identifier lookups fall through with to window, and the options block is arbitrary JavaScript rather than a data literal.

Storing a payload requires flowModels:save, which is an admin or builder permission. Triggering it requires only that any authenticated user view the page. Demonstrated impact includes JWT exfiltration from localStorage. Affects @nocobase/flow-engine through 2.0.32, client-side.

Impact: Stored Cross-Site Scripting leading to session token theft. Also tracked as CWE-95, since the sink is new Function rather than markup injection.

Fixed in 2.0.39. GitHub Security Advisory GHSA-f92q-4wx5-r997 was assigned and is still in triage as of 2026-08-24, so there is no advisory page to cite and no published score. The 8.7 recorded here is the score on the advisory draft. This record will be re-keyed to the advisory when it publishes. One of three companion findings to the SES compartment escape in ENDOR-VUL-2026-16041. Full analysis is in the technical whitepaper.