/Vulnerability Library

NocoBase - SQL Injection

CVE-2026-41640
Verified

Description

NocoBase versions prior to 2.0.39 contain a SQL injection vulnerability in the @nocobase/database package. The queryParentSQL function in eager-loading-tree.ts constructs a recursive CTE query by directly concatenating user-controlled primary key values into the SQL WHERE IN clause without parameterization. An authenticated attacker with record creation permissions on a tree collection with string-type primary keys can inject arbitrary SQL via crafted record identifiers, enabling full database compromise including data exfiltration and modification.

Severity

High

CVSS Score

7.5

Exploit Probability

2%

Affected Product

nocobase

Published Date

April 23, 2026

Template Author

theamanrawat

CVE-2026-41640.yaml
7.5Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-41640
CWE ID:
cwe-89

References

https://github.com/advisories/GHSA-4948-f92q-f432https://nvd.nist.gov/vuln/detail/CVE-2026-41640

Remediation Steps

Upgrade NocoBase to version 2.0.39 or later which uses parameterized bind variables instead of string concatenation in recursive eager loading queries.