Description
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.39, the checkSQL() validation function that blocks dangerous SQL keywords (e.g., pg_read_file, LOAD_FILE, dblink) is applied on the collections:create and sqlCollection:execute endpoints but is entirely missing on the sqlCollection:update endpoint. An attacker with collection management permissions can create a SQL collection with benign SQL, then update it with arbitrary SQL that bypasses all validation, and query the collection to execute the injected SQL and exfiltrate data. This issue has been patched in version 2.0.39.
Affected products
nocobase: nocobase
References5
- github.com/nocobase/nocobase/security/advisories/GHSA-wrwh-c28m… ExploitMitigationVendor Advisory
- github.com/nocobase/nocobase/security/advisories/GHSA-wrwh-c28m… ExploitMitigationVendor Advisory
- github.com/nocobase/nocobase/commit/851aee543efa894142e0f7be03e… Patch
- github.com/nocobase/nocobase/pull/9134 Issue TrackingPatch
- github.com/nocobase/nocobase/releases/tag/v2.0.39 PatchProduct
Metrics
- CVSS 3.1
-
7.2
HIGH
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 2% percentile: 79 · as of 13 November 2026
- CWE
- CWE-89CWE-284
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.