CVE-2026-41640
NocoBase Vulnerable to SQL Injection via String Concatenation in Recursive Eager Loading
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.39, the queryParentSQL() function in the core database package constructs a recursive CTE query by joining nodeIds with string concatenation instead of using parameterized queries. The nodeIds array contains primary key values read from database rows. An attacker who can create a record with a malicious string primary key can inject arbitrary SQL when any subsequent request triggers recursive eager loading on that collection. This issue has been patched in version 2.0.39.
| CWE | CWE-89 |
| Vendor | nocobase |
| Product | nocobase |
| Published | May 7, 2026 |
Stay Ahead of the Next One
Get instant alerts for nocobase nocobase
Be the first to know when new high vulnerabilities affecting nocobase nocobase are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
nocobase / nocobase
< 2.0.39
References
github.com: https://github.com/nocobase/nocobase/security/advisories/GHSA-4948-f92q-f432 github.com: https://github.com/nocobase/nocobase/pull/9133 github.com: https://github.com/nocobase/nocobase/commit/202e2b8efe44ba90adbf1087f6f70881ff947604 github.com: https://github.com/nocobase/nocobase/releases/tag/v2.0.39