CVE-2026-41641 Details
Description
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.39, the checkSQL() validation function that blocks dangerous SQL keywords (e.g., pg_read_file, LOAD_FILE, dblink) is applied on the collections:create and sqlCollection:execute endpoints but is entirely missing on the sqlCollection:update endpoint. An attacker with collection management permissions can create a SQL collection with benign SQL, then update it with arbitrary SQL that bypasses all validation, and query the collection to execute the injected SQL and exfiltrate data. This issue has been patched in version 2.0.39.
A SQL injection vulnerability has been identified in NocoBase versions prior to 2.0.39. The issue arises in the 'sqlCollection:update' endpoint, where the 'checkSQL()' validation function, designed to block dangerous SQL keywords, is not applied. This oversight allows an attacker with collection management permissions to exploit the vulnerability by updating a SQL collection with arbitrary SQL that bypasses validation. The injected SQL can then be executed to exfiltrate data. The vulnerability is present in the '@nocobase/plugin-collection-sql' component, affecting versions through 2.0.38.
Users can update to NocoBase version 2.0.39 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nocobase/nocobase/security/advisories/GHSA-wrwh-c28m-9jjh | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/nocobase/nocobase/commit/851aee543efa894142e0f7be03eb55d9cec06a91 | [email protected] | Patch |
| https://github.com/nocobase/nocobase/pull/9134 | [email protected] | Issue TrackingPatch |
| https://github.com/nocobase/nocobase/releases/tag/v2.0.39 | [email protected] | PatchProduct |
| https://github.com/nocobase/nocobase/security/advisories/GHSA-wrwh-c28m-9jjh | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | [email protected] |
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nocobase nocobase | < 2.0.39 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 7, 2026 | Initial Analysis | [email protected] |
| May 7, 2026 | CVE Modified | CISA-ADP |
| May 7, 2026 | New CVE Received | [email protected] |