CVE-2026-41640 Details

A SQL injection vulnerability has been identified in NocoBase versions prior to 2.0.39. The issue arises in the queryParentSQL() function within the core database package, where a recursive Common Table Expression (CTE) query is constructed by concatenating nodeIds with strings, rather than using parameterized queries. This flaw allows an attacker to inject arbitrary SQL by creating a record with a malicious string primary key, which is then executed when recursive eager loading is applied to that collection.

Users can update to NocoBase version 2.0.39 or later, where this vulnerability has been patched. Additionally, it is recommended to validate primary key values at the time of record creation to reject or escape any values containing SQL metacharacters.