CVE-2026-41640 NocoBase Vulnerable to SQL Injection via String Concatenation in Recursive Eager Loading

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.39, the queryParentSQL function in the core database package constructs a recursive CTE query by joining nodeIds with string concatenation instead of using...

@nocobase/database has SQL Injection via String Concatenation through Recursive Eager Loading

Summary The queryParentSQL function in the core database package constructs a recursive CTE query by joining nodeIds with string concatenation instead of using parameterized queries. The nodeIds array contains primary key values read from database rows. An attacker who can create a record with a...

GHSA-4948-F92Q-F432 @nocobase/database has SQL Injection via String Concatenation through Recursive Eager Loading

Summary The queryParentSQL function in the core database package constructs a recursive CTE query by joining nodeIds with string concatenation instead of using parameterized queries. The nodeIds array contains primary key values read from database rows. An attacker who can create a record with a...

SQL Injection

Overview @nocobase/database is a Affected versions of this package are vulnerable to SQL Injection via the queryParentSQL function. An attacker can execute arbitrary SQL commands, extract sensitive data, modify or delete database records, and potentially cause denial of service by injecting...

CVE-2026-35378 uutils coreutils expr Local Denial of Service via Eager Evaluation of Parenthesized Subexpressions

A logic error in the expr utility of uutils coreutils causes the program to evaluate parenthesized subexpressions during the parsing phase rather than at the execution phase. This implementation flaw prevents the utility from performing proper short-circuiting for logical OR | and AND & operation...

CVE-2026-35378 uutils coreutils expr Local Denial of Service via Eager Evaluation of Parenthesized Subexpressions

A logic error in the expr utility of uutils coreutils causes the program to evaluate parenthesized subexpressions during the parsing phase rather than at the execution phase. This implementation flaw prevents the utility from performing proper short-circuiting for logical OR | and AND & operation...

EUVD-2025-120024

Malicious code in eager-aquamarine-aardwolf npm...

EUVD-2025-117426

Malicious code in eager-maroon-sturgeon npm...

MAL-2025-132953 Malicious code in eager_chimpanzee_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52d8e378070b17cf409f351469344868c7e60dae20bb7a6b6e082107cad6db9d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-125991 Malicious code in eager_tyrannosaurus_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 800d9b691b505754979c0e3b73b02b54344b4e1147a1c497d78b8c9c57c698a6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-99602

Malicious code in eagertyrannosaurusz3n npm...

EUVD-2025-105691

Malicious code in eagerbonoboz3n npm...

EUVD-2025-79364

Malicious code in eagercockroachz3n npm...

EUVD-2025-82122

Malicious code in eagerpony0xrequest npm...

EUVD-2025-82121

Malicious code in eagerpythondumbs npm...

EUVD-2025-82123

Malicious code in eagerplatypus0xrequest npm...

EUVD-2025-64400

Malicious code in eagerjaguarz3n npm...

Malicious code in eager_mink_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c46e2604c3a2279664e1d6547cc10f1fb0259c1acbe7833f5df4fd8d560b839 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in eager-amaranth-pelican (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7770aa399f96d05ea16996490890b30f48a7271b4761d47a54adb2d5edb1012e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in eager-green-prawn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e71ead66acda41e32e3806c2adae804e9981d334bdf5427eec522696df9aca5c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...