saltcorn @saltcorn/data vulnerabilities

Latest saltcorn @saltcorn/data CVEs

Newest publication first

1. GHSA-9237-rg5p-rhfw @saltcorn/data: Tenant user role is used for tenant creation role check

   Published 2026-04-22

   High·CVSS 8.7

   Summary When a tenant admin is logged out of the root domain (e.g., saltcorn.com) but logged in to their own tenant space as admin, they can simply append /tenant/create to their tenant URL. The system reads the role from the tenant context (admin), and a new tenant is created on...

2. GHSA-59xv-588h-2vmm @saltcorn/data vulnerable to SQL Injection via jsexprToSQL Literal Handler

   Published 2026-04-10

   None·CVSS 0.0

   Summary The jsexprToSQL() function in Saltcorn converts JavaScript expressions to SQL for use in database constraints. The Literal handler wraps string values in single quotes without escaping embedded single quotes, allowing SQL injection when creating Formula-type table constra...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.