Executive brief
NocoBase is a platform used to build business applications and enterprise software without writing code. A security flaw in its workflow engine allows users to execute unauthorized database commands by manipulating data that triggers automated tasks. This could lead to an attacker viewing sensitive customer data, modifying records, or gaining full control over the application's database.
Technical details
A SQL injection vulnerability exists in the NocoBase `plugin-workflow-sql` package prior to version 2.0.30. The `getParsedValue()` function in `SQLInstruction.ts` performs direct string substitution of template variables into raw SQL queries without parameterization or escaping. An attacker with the ability to trigger a workflow (e.g., by creating a record that initiates a 'collection-trigger' workflow) can inject arbitrary SQL commands if the workflow contains a SQL node using user-controlled data. This can result in full database read/write access. The issue is fixed in version 2.0.30 by implementing parameterized queries.
Affected products
- NocoBase nocobase/plugin-workflow-sql < 2.0.30
Timeline
- 2026-03-30: patched: Fixed in version 2.0.30 via commit 75da3dd
- 2026-04-01: advisory: GitHub Security Advisory GHSA-vx58-fwwq-5g8j published
- 2026-04-02: disclosed: CVE-2026-34825 published