CVE-2026-41641
NocoBase Vulnerable to SQL Validation Bypass via `sqlCollection:update` Missing `checkSQL` Call
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.39, the checkSQL() validation function that blocks dangerous SQL keywords (e.g., pg_read_file, LOAD_FILE, dblink) is applied on the collections:create and sqlCollection:execute endpoints but is entirely missing on the sqlCollection:update endpoint. An attacker with collection management permissions can create a SQL collection with benign SQL, then update it with arbitrary SQL that bypasses all validation, and query the collection to execute the injected SQL and exfiltrate data. This issue has been patched in version 2.0.39.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | High7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Analyzed | 3.1 | High7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 1.8% · top 21% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: poc · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.2.
Weakness
Affected products
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- npm@nocobase/plugin-collection-sqlGHSA-wrwh-c28m-9jjh (opens in a new tab)
References (4)
- https://github.com/nocobase/nocobase/security/advisories/GHSA-wrwh-c28m-9jjh (opens in a new tab)x_refsource_CONFIRMexploit
- https://github.com/nocobase/nocobase/pull/9134 (opens in a new tab)x_refsource_MISC
- https://github.com/nocobase/nocobase/commit/851aee543efa894142e0f7be03eb55d9cec06a91 (opens in a new tab)x_refsource_MISC
- https://github.com/nocobase/nocobase/releases/tag/v2.0.39 (opens in a new tab)x_refsource_MISC
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-wrwh-c28m-9jjh (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-41641)Record last updated .