CVE-2026-41640

HIGH EPSS 76.8%

Published May 7, 20261mo ago · Modified Jun 17, 20262w ago

8.8 CVSS 3.1

High

Published May 7, 2026 1mo ago

Last Modified Jun 17, 2026 2w ago

Description

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.39, the queryParentSQL() function in the core database package constructs a recursive CTE query by joining nodeIds with string concatenation instead of using parameterized queries. The nodeIds array contains primary key values read from database rows. An attacker who can create a record with a malicious string primary key can inject arbitrary SQL when any subsequent request triggers recursive eager loading on that collection. This issue has been patched in version 2.0.39.

CVSS Details

Base Score

8.8

Exploitability

2.8

Impact

5.9

Vector string

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector Network

Attack Complexity Low

Privileges Required Low

User Interaction None

Scope Unchanged

Confidentiality High

Integrity High

Availability High

Threat Intelligence

EPSS Exploit Probability

76.8% percentile

Exploit & Patch Status

Public Exploit Known

Patch Available

Weaknesses 1

CWE-89 SQL Injection Injection

Affected Products 1

Vendor	Product	Version	Range
nocobase	nocobase	*	<2.0.39

References 4

github.com https://github.com/nocobase/nocobase/commit/202e2b8efe44ba90adbf1087f6f70881ff947604

Patch
github.com https://github.com/nocobase/nocobase/pull/9133

Issue TrackingPatch
github.com https://github.com/nocobase/nocobase/releases/tag/v2.0.39

PatchRelease Notes
github.com https://github.com/nocobase/nocobase/security/advisories/GHSA-4948-f92q-f432

ExploitMitigationVendor Advisory

Remediation

github.com https://github.com/nocobase/nocobase/commit/202e2b8efe44ba90adbf1087f6f70881ff947604

Patch
github.com https://github.com/nocobase/nocobase/pull/9133

Issue TrackingPatch
github.com https://github.com/nocobase/nocobase/releases/tag/v2.0.39

PatchRelease Notes