CVE-2026-112306
NocoBase plugin-collection-sql through 2.2.28 SQL Injection via sqlCollection:setFields
CVSS Score
7.2
EPSS Score
0.0%
EPSS Percentile
0th
NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL() through the sqlCollection:setFields action. Attackers holding the collection-sql snippet can replace a benign collection query with dangerous statements executed on reload, reading pg_shadow password hashes or calling pg_read_file.
| CWE | CWE-89 |
| Vendor | nocobase |
| Product | nocobase |
| Published | Oct 19, 2026 |
| Last Updated | Oct 19, 2026 |
Stay Ahead of the Next One
Get instant alerts for nocobase nocobase
Be the first to know when new high vulnerabilities affecting nocobase nocobase are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
nocobase / nocobase
0 ≤ 2.2.28
References
github.com: https://github.com/nocobase/nocobase/issues/10629 github.com: https://github.com/nocobase/nocobase/blob/v2.2.28/packages/plugins/@nocobase/plugin-collection-sql/src/server/resources/sql.ts#L14-L104 github.com: https://github.com/nocobase/nocobase vulncheck.com: https://www.vulncheck.com/advisories/nocobase-plugin-collection-sql-through-2.2.28-sql-injection-via-sqlcollection-setfields
Credits
George Chen Zachariah Mithani