CVE-2026-34825highCWE-89

CVE-2026-34825: falha de alta gravidade em nocobase

NocoBase Has SQL Injection via template variable substitution in workflow SQL node

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar nocobase+ Monitorar @nocobase/plugin-workflow-sql

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.5epss 0.4%
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.30, NocoBase plugin-workflow-sql substitutes template variables directly into raw SQL strings via getParsedValue() without parameterization or escaping. Any user who triggers a workflow containing a SQL node with template variables from user-controlled data can inject arbitrary SQL. This issue has been patched in version 2.0.30.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
nocobase · nocobase
CVEs relacionadas — nocobase

No mesmo produto, das mais perigosas para as menos.

CVE-2026-34156CRITICALNocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script NodeEPSS 35.0%CVE-2026-41640HIGHNocoBase Vulnerable to SQL Injection via String Concatenation in Recursive Eager LoadingEPSS 1.9%CVE-2026-41641HIGHNocoBase Vulnerable to SQL Validation Bypass via `sqlCollection:update` Missing `checkSQL` CallEPSS 1.8%CVE-2026-52887CRITICALNocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCEEPSS 0.9%CVE-2026-55410MEDIUMNocoBase backup restore schema name allows command injectionEPSS 0.7%CVE-2026-52888MEDIUMNocoBase: Sensitive Data Exposure via SQL Blacklist BypassEPSS 0.5%