nocobase @nocobase/plugin-collection-sql vulnerabilities

Latest nocobase @nocobase/plugin-collection-sql CVEs

Newest publication first

1. CVE-2026-52888 NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass

   Published 2026-07-15

   Medium·CVSS 6.8 EPSS 0.47%

   NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. In 2.0.59 and earlier, NocoBase @nocobase/plugin-collection-sql used the checkSQL() function in packages/plugins/@nocobase/plugin-collection-sql/src/server/utils.ts wi...

2. CVE-2026-41641 NocoBase Vulnerable to SQL Validation Bypass via `sqlCollection:update` Missing `checkSQL` Call

   Published 2026-05-07

   High·CVSS 7.2 EPSS 1.8%

   NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.39, the checkSQL() validation function that blocks dangerous SQL keywords (e.g., pg_read_file, LOAD_FILE, dblink) is applied on the collections:cr...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.