CVE-2026-34825: NocoBase SQL injection in workflow SQL node

CVE-2026-34825 · Severity: medium · CVSS 6.5 · Published 2026-04-02

NocoBase is a platform used to build business applications and enterprise software without writing code. A security flaw in its workflow engine allows users to execute unauthorized database commands by manipulating data that triggers automated tasks. This could lead to an attacker viewing sensitive customer data, modifying records, or gaining full control over the application's database.

Technologies: Nocobase. Vendors: NocoBase, npm.

Quick answers

Is CVE-2026-34825 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-34825 being exploited in the wild.
How severe is CVE-2026-34825?
Medium severity, with a CVSS score of 6.5, published 2 April 2026.
Which products and versions are affected?
NocoBase Plugin-Workflow-Sql <= 2.0.29; @nocobase/plugin-workflow-sql (npm) <= 2.0.29, SEMVER:introduced=0,fixed=2.0.30.
Is there a fix for CVE-2026-34825?
Yes. @nocobase/plugin-workflow-sql (npm): upgrade to 2.0.30 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34825 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-34825?
Check whether you run Nocobase, NocoBase Plugin-Workflow-Sql, NocoBase Workflow SQL Plugin or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @nocobase/plugin-workflow-sql (npm): upgrade to 2.0.30 or later
    npm install @nocobase/plugin-workflow-sql@2.0.30

Technical details

A SQL injection vulnerability exists in the NocoBase `plugin-workflow-sql` package prior to version 2.0.30. The `getParsedValue()` function in `SQLInstruction.ts` performs direct string substitution of template variables into raw SQL queries without parameterization or escaping. An attacker with the ability to trigger a workflow (e.g., by creating a record that initiates a 'collection-trigger' workflow) can inject arbitrary SQL commands if the workflow contains a SQL node using user-controlled data. This can result in full database read/write access. The issue is fixed in version 2.0.30 by implementing parameterized queries.

Affected products

  • NocoBase nocobase/plugin-workflow-sql < 2.0.30

Identifiers

  • CVE-2026-34825
  • GHSA-vx58-fwwq-5g8j

Timeline

  • 2026-03-30: patched: Fixed in version 2.0.30 via commit 75da3dd
  • 2026-04-01: advisory: GitHub Security Advisory GHSA-vx58-fwwq-5g8j published
  • 2026-04-02: disclosed: CVE-2026-34825 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.