NocoBase - VM Sandbox Escape to Remote Code Execution

NocoBase Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allowlist controlled by WORKFLOWSCRIPTMODULES env var. The console object passed into the sandbox context exposes host-realm WritableWorkerStdio stream objects via console.stdout and...

NocoBase - SQL Injection

NocoBase versions prior to 2.0.39 contain a SQL injection vulnerability in the @nocobase/database package. The queryParentSQL function in eager-loading-tree.ts constructs a recursive CTE query by directly concatenating user-controlled primary key values into the SQL WHERE IN clause without...

NocoBase - SQL Injection

NocoBase @nocobase/plugin-collection-sql versions prior to 2.0.39 are vulnerable to SQL injection via the sqlCollection:update endpoint. The checkSQL function, which blocks dangerous SQL keywords and ensures only SELECT statements are allowed, is not called during collection updates. id:...

CVE-2026-34156

🚨 CVE-2026-34156 - NocoBase Critical Sandbox Escape Unauthenticated / Low-Privilege → Root Remote Code Execution in NocoBase 📌 Overview CVE-2026-34156 is a critical sandbox escape vulnerability in NocoBase an open-source no-code/low-code platform. An attacker with the ability to create or execute...

CVE-2026-52887-NocoBase-SQLi-RCE

CVE-2026-52887 — NocoBase SQL Injection → PostgreSQL-superuser RCE SQL injection in the myInAppChannels:list action of NocoBase's @nocobase/plugin-notification-in-app-message ≤ 2.0.60. The filterlatestMsgReceiveTimestamp$lt request parameter is interpolated directly into a raw Sequelize.literal S...

Exploit for CVE-2026-52887

nocobase-cve-2026-52887 NocoBase security research and exploi...

CVE-2026-34156-NocoBase-Sandbox-Escape-via-Workflow-Execution-Vulnerability-

CVE-2026-34156 – NocoBase Sandbox Escape RCE -orange Authenticated Remote Code Execution in NocoBase versions ≤ 2.0.26 via workflow sandbox escape. 📋 Description CVE-2026-34156 is a sandbox escape vulnerability in the NocoBase workflow engine. An authenticated attacker can create a malicious...

CVE-2026-112306

NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL through the sqlCollection:setFields action. Attackers holding the collection-sql snippet can replace a benign collection quer...

EUVD-2026-104398

NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL through the sqlCollection:setFields action. Attackers holding the collection-sql snippet can replace a benign collection quer...

CVE-2026-112306 NocoBase plugin-collection-sql through 2.2.28 SQL Injection via sqlCollection:setFields

NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL through the sqlCollection:setFields action. Attackers holding the collection-sql snippet can replace a benign collection quer...

CVE-2026-112306 NocoBase plugin-collection-sql through 2.2.28 SQL Injection via sqlCollection:setFields

NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL through the sqlCollection:setFields action. Attackers holding the collection-sql snippet can replace a benign collection quer...

CVE-2026-112306

The NocoBase @nocobase/plugin-collection-sql component, version 2.2.28 and below , is vulnerable to an SQL injection flaw. The root cause is the ability for privileged users to bypass the checkSQL() validation via the sqlCollection:setFields action. This allows an attacker with the collection-sql...

PT-2026-117466

NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL through the sqlCollection:setFields action. Attackers holding the collection-sql snippet can replace a benign collection quer...

CVE-2026-88403

A Server-Side Request Forgery SSRF in the serverRequest function of nocobase v2.1.21 allows authenticated attackers to scan internal resources via a crafted HTTP request...

CVE-2026-88402

A SQL injection vulnerability in the checkSQL function of nocobase v2.1.21 allows attackers to access sesntive database information via injecting crafted SQL statements...

CVE-2026-88403

A Server-Side Request Forgery (SSRF) vulnerability exists in the serverRequest function of nocobase v2.1.21 . This flaw allows authenticated attackers to perform internal resource scanning by sending a crafted HTTP request . No specific remediation, exploit links, or MITRE ATT&CK IDs are provided...

CVE-2026-88402

A SQL injection vulnerability in the checkSQL function of nocobase v2.1.21 allows attackers to access sesntive database information via injecting crafted SQL statements...

EUVD-2026-84200

A Server-Side Request Forgery SSRF in the serverRequest function of nocobase v2.1.21 allows authenticated attackers to scan internal resources via a crafted HTTP request...

CVE-2026-88403

A Server-Side Request Forgery SSRF in the serverRequest function of nocobase v2.1.21 allows authenticated attackers to scan internal resources via a crafted HTTP request...

CVE-2026-88402

A SQL injection vulnerability in the checkSQL function of nocobase v2.1.21 allows attackers to access sesntive database information via injecting crafted SQL statements...