121 matches found
CVE-2026-52887-NocoBase-SQLi-RCE
CVE-2026-52887 — NocoBase SQL 注入 → PostgreSQL 超级用户 RCE myInAppChannels:list 操作中存在 SQL 注入，影响 NocoBase 的 @nocobase/plugin-notification-in-app-message（≤ 2.0.60）。filterlatestMsgReceiveTimestamp$lt 请求参数被直接插入到原始 Sequelize.literal SQL 字符串中，未进行任何转义或参数绑定。借助 PostgreSQL pg 驱动对堆叠语句的支持，该注入可到达 COPY … TO...
NocoBase - SQL Injection
NocoBase @nocobase/plugin-collection-sql versions prior to 2.0.39 are vulnerable to SQL injection via the sqlCollection:update endpoint. The checkSQL function, which blocks dangerous SQL keywords and ensures only SELECT statements are allowed, is not called during collection updates. id:...
NocoBase - SQL Injection
NocoBase versions prior to 2.0.39 contain a SQL injection vulnerability in the @nocobase/database package. The queryParentSQL function in eager-loading-tree.ts constructs a recursive CTE query by directly concatenating user-controlled primary key values into the SQL WHERE IN clause without...
NocoBase - VM Sandbox Escape to Remote Code Execution
NocoBase Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allowlist controlled by WORKFLOWSCRIPTMODULES env var. The console object passed into the sandbox context exposes host-realm WritableWorkerStdio stream objects via console.stdout and...
CVE-2026-34156
🚨 CVE-2026-34156 - NocoBase 严重沙箱逃逸漏洞 NocoBase 中未经认证 / 低权限 → 以 root 身份远程代码执行 📌 概述 CVE-2026-34156 是 NocoBase （一个开源无代码/低代码平台）中的严重沙箱逃逸漏洞。 具备创建或执行工作流脚本节点 能力（即使是低权限）的攻击者，可以逃逸 Node.js vm 沙箱，并在容器内实现以 root 身份完全远程代码执行 。 受影响版本 NocoBase 仓库包含 ：完整 PoC 脚本、Nuclei 模板和安全检测器。...
CVE-2026-34156-NocoBase-Sandbox-Escape-via-Workflow-Execution-Vulnerability-
CVE-2026-34156 – NocoBase 沙箱逃逸（RCE） -orange 经过身份验证的远程代码执行 ，影响 NocoBase 版本 ≤ 2.0.26 ，可通过工作流沙箱逃逸触发。 📋 描述 CVE-2026-34156 是 NocoBase 工作流引擎中的一个沙箱逃逸漏洞。经过身份验证的攻击者可以创建一个恶意工作流，绕过表达式沙箱并在底层服务器上执行任意系统命令。 攻击向量 – 向 NocoBase API 发送经身份验证的 HTTP 请求 所需权限 – 低（任何拥有工作流创建权限的有效用户） 影响 – 完整的 RCE（如果以 root 身份运行，还可能实现容器逃逸） 🔧...
Command Injection
NocoBase is vulnerable to Command Injection. The vulnerability is due to unsanitized interpolation of the database.schema value from crafted backup metadata into shell commands executed with childprocess.exec, which allows an authenticated backup-management user to execute arbitrary commands with...
CVE-2026-84701
NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Attackers can write arbitrary markup through the collection API that executes in the browsers of all users viewing the affected record...
CVE-2026-84701 NocoBase Rich Text Field Stored Cross-Site Scripting via API
NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Attackers can write arbitrary markup through the collection API that executes in the browsers of all users viewing the affected record...
EUVD-2026-69792
NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Attackers can write arbitrary markup through the collection API that executes in the browsers of all users viewing the affected record...
CVE-2026-84701 NocoBase Rich Text Field Stored Cross-Site Scripting via API
NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Attackers can write arbitrary markup through the collection API that executes in the browsers of all users viewing the affected record...
CVE-2026-84701
NocoBase is vulnerable to stored cross-site scripting (XSS) due to insufficient sanitization of rich text field values in the read renderer (specifically ReadPretty.tsx). An attacker with create permissions can inject arbitrary HTML with event handlers via the collection API, which then executes ...
CVE-2026-84701 NocoBase Rich Text Field Stored Cross-Site Scripting via API
NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Attackers can write arbitrary markup through the collection API that executes in the browsers of all users viewing the affected record...
CVE-2026-55410
creationtimestamp| type| source ---|---|--- 2026-08-20 20:35:18+00:00| published-proof-of-concept| https://github.com/nocobase/nocobase/security/advisories/GHSA-p853-83gj-wjj3...
NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution
Executive Summary Two vulnerabilities were identified and chained to achieve authenticated remote code execution The first vulnerability allows any authenticated admin to redirect the file upload storage root to an arbitrary path on disk including the application directory itself by supplying an...
@nocobase/devtools (>=2.0.0-alpha.2, <=2.1.0-beta.44), @nocobase/test (>=2.0.0-alpha.2, <=2.1.0-beta.44) potentially affected by unknown CVE via @nocobase/server (>=2.0.0, <=2.1.0-beta.44)
@nocobase/server NPM version =2.0.0, =2.0.0-alpha.2, =2.0.0-alpha.2, =2.1.0-beta.44 Source cves: unknown CVE Source advisory: OSV:GHSA-GHVF-QF6H-G8X5...
GHSA-P853-83GJ-WJJ3 NocoBase backup restore schema name allows command injection
Summary NocoBase @nocobase/plugin-backups 2.0.57 restores PostgreSQL backups by interpolating the backup metadata schema name into shell command strings that are executed with Node.js childprocess.exec. A backup-management user who can restore an uploaded PostgreSQL backup with forced schema...
EUVD-2026-44804
NocoBase backup restore schema name allows command injection...
NocoBase backup restore schema name allows command injection
Summary NocoBase @nocobase/plugin-backups 2.0.57 restores PostgreSQL backups by interpolating the backup metadata schema name into shell command strings that are executed with Node.js childprocess.exec. A backup-management user who can restore an uploaded PostgreSQL backup with forced schema...