121 matches found
NocoBase - SQL Injection
NocoBase versions prior to 2.0.39 contain a SQL injection vulnerability in the @nocobase/database package. The queryParentSQL function in eager-loading-tree.ts constructs a recursive CTE query by directly concatenating user-controlled primary key values into the SQL WHERE IN clause without...
NocoBase - SQL Injection
NocoBase @nocobase/plugin-collection-sql versions prior to 2.0.39 are vulnerable to SQL injection via the sqlCollection:update endpoint. The checkSQL function, which blocks dangerous SQL keywords and ensures only SELECT statements are allowed, is not called during collection updates. id:...
NocoBase - VM Sandbox Escape to Remote Code Execution
NocoBase Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allowlist controlled by WORKFLOWSCRIPTMODULES env var. The console object passed into the sandbox context exposes host-realm WritableWorkerStdio stream objects via console.stdout and...
CVE-2026-34156
🚨 CVE-2026-34156 - Escape Crítico de Sandbox en NocoBase Sin autenticación / privilegios bajos → ejecución remota de código como root en NocoBase 📌 Resumen CVE-2026-34156 es una vulnerabilidad crítica de escape de sandbox en NocoBase una plataforma de código abierto no-code/low-code. Un atacante...
CVE-2026-34156-NocoBase-Sandbox-Escape-via-Workflow-Execution-Vulnerability-
CVE-2026-34156 – Escape del Sandbox de NocoBase RCE -orange Ejecución Remota de Código autenticada en versiones de NocoBase ≤ 2.0.26 mediante escape del sandbox del flujo de trabajo. 📋 Descripción CVE-2026-34156 es una vulnerabilidad de escape del sandbox en el motor de flujo de trabajo de...
CVE-2026-52887-NocoBase-SQLi-RCE
CVE-2026-52887 — Inyección SQL en NocoBase → RCE como superusuario de PostgreSQL Inyección SQL en la acción myInAppChannels:list del plugin @nocobase/plugin-notification-in-app-message de NocoBase ≤ 2.0.60. El parámetro de solicitud filterlatestMsgReceiveTimestamp$lt se interpola directamente en...
Command Injection
NocoBase is vulnerable to Command Injection. The vulnerability is due to unsanitized interpolation of the database.schema value from crafted backup metadata into shell commands executed with childprocess.exec, which allows an authenticated backup-management user to execute arbitrary commands with...
CVE-2026-84701
NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Attackers can write arbitrary markup through the collection API that executes in the browsers of all users viewing the affected record...
CVE-2026-84701 NocoBase Rich Text Field Stored Cross-Site Scripting via API
NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Attackers can write arbitrary markup through the collection API that executes in the browsers of all users viewing the affected record...
EUVD-2026-69792
NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Attackers can write arbitrary markup through the collection API that executes in the browsers of all users viewing the affected record...
CVE-2026-84701 NocoBase Rich Text Field Stored Cross-Site Scripting via API
NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Attackers can write arbitrary markup through the collection API that executes in the browsers of all users viewing the affected record...
CVE-2026-84701
NocoBase is vulnerable to stored cross-site scripting (XSS) due to insufficient sanitization of rich text field values in the read renderer (specifically ReadPretty.tsx). An attacker with create permissions can inject arbitrary HTML with event handlers via the collection API, which then executes ...
CVE-2026-84701 NocoBase Rich Text Field Stored Cross-Site Scripting via API
NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Attackers can write arbitrary markup through the collection API that executes in the browsers of all users viewing the affected record...
CVE-2026-55410
creationtimestamp| type| source ---|---|--- 2026-08-20 20:35:18+00:00| published-proof-of-concept| https://github.com/nocobase/nocobase/security/advisories/GHSA-p853-83gj-wjj3...
NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution
Executive Summary Two vulnerabilities were identified and chained to achieve authenticated remote code execution The first vulnerability allows any authenticated admin to redirect the file upload storage root to an arbitrary path on disk including the application directory itself by supplying an...
@nocobase/devtools (>=2.0.0-alpha.2, <=2.1.0-beta.44), @nocobase/test (>=2.0.0-alpha.2, <=2.1.0-beta.44) potentially affected by unknown CVE via @nocobase/server (>=2.0.0, <=2.1.0-beta.44)
@nocobase/server NPM version =2.0.0, =2.0.0-alpha.2, =2.0.0-alpha.2, =2.1.0-beta.44 Source cves: unknown CVE Source advisory: OSV:GHSA-GHVF-QF6H-G8X5...
GHSA-P853-83GJ-WJJ3 NocoBase backup restore schema name allows command injection
Summary NocoBase @nocobase/plugin-backups 2.0.57 restores PostgreSQL backups by interpolating the backup metadata schema name into shell command strings that are executed with Node.js childprocess.exec. A backup-management user who can restore an uploaded PostgreSQL backup with forced schema...
EUVD-2026-44804
NocoBase backup restore schema name allows command injection...
NocoBase backup restore schema name allows command injection
Summary NocoBase @nocobase/plugin-backups 2.0.57 restores PostgreSQL backups by interpolating the backup metadata schema name into shell command strings that are executed with Node.js childprocess.exec. A backup-management user who can restore an uploaded PostgreSQL backup with forced schema...