CVE-2026-34825

Summary (CVE-2026-34825) NocoBase’s plugin-workflow-sql component (pre-2.0.30) builds SQL by substituting template variables directly into raw SQL strings via getParsedValue(), with no parameterization or escaping. An attacker who triggers a workflow containing a SQL node using user-controlled da...

CVE-2026-34825: Improper Neutralization of Special Elements used in an SQL Command

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.30, NocoBase plugin-workflow-sql substitutes template variables directly into raw SQL strings via getParsedValue without parameterization or escaping. Any user who...

SQL Injection

Overview @nocobase/plugin-workflow-sql is an Execute SQL statements in workflow. Affected versions of this package are vulnerable to SQL Injection via the getParsedValue function. An attacker can execute arbitrary SQL commands by supplying crafted input to template variables processed in workflow...