SQL Injection in Nocobase
CVE-2026-41641
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.39, the checkSQL() validation function that blocks dangerous SQL keywords (e.g., pg_read_file, LOAD_FILE, dblink) is applied on the collections:create and sqlCollection:execute endpoints but is entirely missing on the sqlCollection:update endpoint. An attacker with collection management permissions can create a SQL collection with benign SQL, then update it with arbitrary SQL that bypasses all validation, and query the collection to execute the injected SQL and exfiltrate data. This issue has been patched in version 2.0.39.
Vulnerability class: SQL Injection
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.024 (83.1th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 83rd percentile — 83.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.018 · newest: 0.024 · change: +0.005
Affected products
- Nocobase — versions < 2.0.39
Weakness classification (CWE)
References
- github.com/nocobase/nocobase/security/advisories/GHSA-wrwh-c28m-9jjh (Exploit, Mitigation, Vendor Advisory)
- github.com/nocobase/nocobase/pull/9134 (Patch, Issue Tracking)
- github.com/nocobase/nocobase/commit/851aee543efa894142e0f7be03eb55d9cec06a91 (Patch)
- github.com/nocobase/nocobase/releases/tag/v2.0.39 (Product, Patch)
Frequently asked questions
- What is CVE-2026-41641?
- CVE-2026-41641 is a high-severity vulnerability in Nocobase, classified under SQL Injection. CVSS score: 7.2/10. Published 2026-05-07.
- How severe is CVE-2026-41641?
- High severity. CVSS v3 base score is 7.2 out of 10.