CVE-2026-41640: high-severity vulnerability in nocobase
NocoBase Vulnerable to SQL Injection via String Concatenation in Recursive Eager Loading
Published
36Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 7.5epss 2.4%
exploitation probability
2.4%top 16% of all CVEs
observed exploitation
nono source reports it
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.39, the queryParentSQL() function in the core database package constructs a recursive CTE query by joining nodeIds with string concatenation instead of using parameterized queries. The nodeIds array contains primary key values read from database rows. An attacker who can create a record with a malicious string primary key can inject arbitrary SQL when any subsequent request triggers recursive eager loading on that collection. This issue has been patched in version 2.0.39.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
nocobase · nocobaseRelated CVEs — nocobase
In the same product, most dangerous first.
CVE-2026-34156CRITICALNocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script NodeEPSS 6.8%CVE-2026-41641HIGHNocoBase Vulnerable to SQL Validation Bypass via `sqlCollection:update` Missing `checkSQL` CallEPSS 2.4%CVE-2026-52887CRITICALNocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCEEPSS 0.9%CVE-2026-55410MEDIUMNocoBase backup restore schema name allows command injectionEPSS 0.7%CVE-2026-34825HIGHNocoBase Has SQL Injection via template variable substitution in workflow SQL nodeEPSS 0.5%CVE-2026-52888MEDIUMNocoBase: Sensitive Data Exposure via SQL Blacklist BypassEPSS 0.5%