VYPR
Get started
← All advisories
High severity7.2NVD Advisory· Published May 7, 2026· Updated May 7, 2026

CVE-2026-41641

CVE-2026-41641

Description

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.39, the checkSQL() validation function that blocks dangerous SQL keywords (e.g., pg_read_file, LOAD_FILE, dblink) is applied on the collections:create and sqlCollection:execute endpoints but is entirely missing on the sqlCollection:update endpoint. An attacker with collection management permissions can create a SQL collection with benign SQL, then update it with arbitrary SQL that bypasses all validation, and query the collection to execute the injected SQL and exfiltrate data. This issue has been patched in version 2.0.39.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
@nocobase/plugin-collection-sqlnpm
< 2.0.392.0.39

Affected products

2

Patches

1
851aee543efa

fix(collection-sql): validate sql on update (#9134)

https://github.com/nocobase/nocobaseYANG QIAApr 17, 2026via ghsa
commitPR #9134
2 files changed · +69 −0
  • packages/plugins/@nocobase/plugin-collection-sql/src/server/resources/sql.ts+8 −0 modified
    @@ -103,6 +103,14 @@ export default {
       await next();
     },
     update: async (ctx: Context, next: Next) => {
+      const { sql } = ctx.action.params.values || {};
+      if (sql) {
+        try {
+          checkSQL(sql);
+        } catch (e) {
+          ctx.throw(400, ctx.t(e.message));
+        }
+      }
       const transaction = await ctx.app.db.sequelize.transaction();
       try {
         const { upRes } = await updateCollection(ctx, transaction);
  • packages/plugins/@nocobase/plugin-collection-sql/src/server/__tests__/actions.test.ts+61 −0 modified
    @@ -186,6 +186,67 @@ describe('sql collection', () => {
     expect(loadedFields2.size).toBe(1);
   });
 
+  it('sqlCollection:update: should check sql', async () => {
+    await agent.resource('collections').create({
+      values: {
+        name: 'fakeCollection',
+        fields: [
+          {
+            name: 'testField1',
+            type: 'string',
+            interface: 'input',
+          },
+        ],
+      },
+    });
+    await agent.resource('collections').create({
+      values: {
+        name: 'sqlCollection',
+        sql: 'select * from "fakeCollection"',
+        template: 'sql',
+        fields: [
+          {
+            name: 'testField1',
+            type: 'string',
+            interface: 'input',
+          },
+        ],
+      },
+    });
+
+    const collection = await db.getRepository('collections').findOne({
+      filter: {
+        name: 'sqlCollection',
+      },
+    });
+
+    const updateRes = await agent.resource('sqlCollection').update({
+      filterByTk: 'sqlCollection',
+      values: {
+        key: collection.key,
+        sql: "select pg_read_file('/etc/passwd')",
+        name: 'sqlCollection',
+        fields: [
+          {
+            name: 'testField1',
+            type: 'string',
+            interface: 'input',
+          },
+        ],
+      },
+    });
+
+    expect(updateRes.status).toBe(400);
+    expect(updateRes.body.errors[0].message).toMatch('SQL statements contain dangerous keywords');
+
+    const collectionAfterUpdate = await db.getRepository('collections').findOne({
+      filter: {
+        name: 'sqlCollection',
+      },
+    });
+    expect(collectionAfterUpdate.options.sql).toBe('select * from "fakeCollection"');
+  });
+
   it('sqlCollection:setFields', async () => {
     await agent.resource('collections').create({
       values: {

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.