CVE-2026-41641

🗓️ 07 May 2026 04:13:33Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 3 Views🌐 WEB

NocoBase before 2.0.39 omits checkSQL on sqlCollection:update, enabling SQL injection and data exfiltration.

Reporter	Title	Published	Views	Family All 12
ATTACKERKB	CVE-2026-41641	7 May 202604:13	–	attackerkb
Circl	CVE-2026-41641	23 Apr 202609:48	–	circl
CNNVD	Nocobase SQL注入漏洞	7 May 202600:00	–	cnnvd
Cvelist	CVE-2026-41641 NocoBase Vulnerable to SQL Validation Bypass via `sqlCollection:update` Missing `checkSQL` Call	7 May 202604:13	–	cvelist
EUVD	EUVD-2026-28318	7 May 202604:13	–	euvd
Github Security Blog	@nocobase/plugin-collection-sql: SQL Validation Bypass Through Missing `checkSQL` Call	22 Apr 202620:07	–	github
Nuclei	NocoBase - SQL Injection	3 Jun 202606:04	–	nuclei
NVD	CVE-2026-41641	7 May 202606:16	–	nvd
OSV	GHSA-WRWH-C28M-9JJH @nocobase/plugin-collection-sql: SQL Validation Bypass Through Missing `checkSQL` Call	22 Apr 202620:07	–	osv
Positive Technologies	PT-2026-34610	22 Apr 202600:00	–	ptsecurity

NVD

Vulners

Node

nocobase nocobaseRange<2.0.39

[
  {
    "vendor": "nocobase",
    "product": "nocobase",
    "versions": [
      {
        "version": "< 2.0.39",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/nocobase/nocobase/security/advisories/GHSA-wrwh-c28m-9jjh
github	www.github.com/nocobase/nocobase/commit/851aee543efa894142e0f7be03eb55d9cec06a91
github	www.github.com/nocobase/nocobase/pull/9134
github	www.github.com/nocobase/nocobase/releases/tag/v2.0.39

Parameter	Position	Path	Description	CWE
sql	request body	sqlCollection:update	Update endpoint lacks checkSQL() validation, enabling an attacker with collection management permissions to inject arbitrary SQL and exfiltrate data.	CWE-284, CWE-89

07 May 2026 20:23Current

6Medium risk

Vulners AI Score6

CVSS 3.17.2

EPSS0.00194

SSVC