CVE-2026-88402 Details

A SQL injection vulnerability has been identified in Nocobase version 2.1.21, specifically within the '@nocobase/plugin-collection-sql' plugin. The issue arises in the 'checkSQL' function, which improperly validates SQL statements by only checking the first statement in a multi-statement input. This flaw allows attackers to inject and execute additional SQL commands, bypassing security measures intended to prevent the use of dangerous keywords. The vulnerability is particularly severe in MySQL and MariaDB environments, where the execution of multiple statements is permitted.

To address this vulnerability, the SQL validation process should be revised to check the entire SQL string, rejecting any input that contains semicolons or multiple statements. Additionally, the 'multipleStatements: true' option should be removed from the MySQL/MariaDB Sequelize configuration, as it is unnecessary for queries that only involve SELECT statements. Finally, using parameterized queries or prepared statements instead of raw SQL execution can help prevent similar vulnerabilities.