Vulnerabilities in nocobase
13 resultsCVE-2026-34156CRITICALNocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script NodeEPSS 35.0%CVE-2026-41640HIGHNocoBase Vulnerable to SQL Injection via String Concatenation in Recursive Eager LoadingEPSS 1.9%CVE-2026-41641HIGHNocoBase Vulnerable to SQL Validation Bypass via `sqlCollection:update` Missing `checkSQL` CallEPSS 1.8%CVE-2026-52887CRITICALNocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCEEPSS 0.9%CVE-2026-55410MEDIUMNocoBase backup restore schema name allows command injectionEPSS 0.7%CVE-2026-52888MEDIUMNocoBase: Sensitive Data Exposure via SQL Blacklist BypassEPSS 0.5%CVE-2026-34825HIGHNocoBase Has SQL Injection via template variable substitution in workflow SQL nodeEPSS 0.4%CVE-2026-40346MEDIUMNocoBase has SSRF in Workflow HTTP Request and Custom Request PluginsEPSS 0.4%CVE-2026-58468MEDIUMNocoBase 2.1.20 Server-Side Request Forgery via serverRequest wrapperEPSS 0.3%CVE-2026-112306HIGHNocoBase plugin-collection-sql through 2.2.28 SQL Injection via sqlCollection:setFieldsEPSS 0.3%CVE-2026-6224MEDIUMnocobase plugin-workflow-javascript Vm.js createSafeConsole sandboxEPSS 0.3%CVE-2026-84701MEDIUMNocoBase Rich Text Field Stored Cross-Site Scripting via APIEPSS 0.3%CVE-2026-125397HIGHNocoBase plugin-ai 2.1.0 through 2.2.41 Authorization Bypass via Sub-Agent Username OverrideEPSS —