CVE-2026-41640 PoC

Description

NocoBase versions prior to 2.0.39 contain a SQL injection vulnerability in the @nocobase/database package. The queryParentSQL function in eager-loading-tree.ts constructs a recursive CTE query by directly concatenating user-controlled primary key values into the SQL WHERE IN clause without parameterization. An authenticated attacker with record creation permissions on a tree collection with string-type primary keys can inject arbitrary SQL via crafted record identifiers, enabling full database compromise including data exfiltration and modification.

File Snapshot

 id: CVE-2026-41640

info:
  name: NocoBase - SQL Injection
  author: theamanrawat
  severity: high
 

...

Remarks