CVE-2026-41640: NocoBase SQL injection in recursive eager loading

CVE-2026-41640 · Severity: high · CVSS 7.5 · Published 2026-05-07

NocoBase is a low-code database platform used to build business applications. The core database module contains a SQL injection vulnerability in its recursive tree data loading feature. An attacker with permission to create records in a tree-structured collection can inject arbitrary SQL by crafting a malicious primary key value, allowing them to extract sensitive data (user credentials, password hashes) or potentially execute operating system commands on the database server.

Technologies: Nocobase. Vendors: NocoBase, npm.

Quick answers

Is CVE-2026-41640 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41640 being exploited in the wild.
How severe is CVE-2026-41640?
High severity, with a CVSS score of 7.5, published 7 May 2026.
Which products and versions are affected?
Nocobase < 2.0.39, <=2.0.32; @nocobase/database (npm) SEMVER:introduced=0,fixed=2.0.39.
Is there a fix for CVE-2026-41640?
Yes. @nocobase/database (npm): upgrade to 2.0.39 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41640 attacked?
It is attacked over the network.
Am I affected by CVE-2026-41640?
Check whether you run Nocobase or @nocobase/database (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @nocobase/database (npm): upgrade to 2.0.39 or later
    npm install @nocobase/database@2.0.39

Technical details

The vulnerability exists in the queryParentSQL() function (packages/core/database/src/eager-loading-tree.ts:59-84), which builds a recursive CTE query using string concatenation of nodeIds array values rather than parameterized queries. The nodeIds are sourced from database rows read during eager loading of BelongsTo associations with recursively: true flag. An attacker who can create a record with a crafted string primary key containing SQL metacharacters can break out of the WHERE clause and inject additional UNION ALL branches or subqueries. The attack is triggered when any subsequent request performs recursive eager loading on that collection. Proof-of-concept demonstrates error-based data extraction using CAST-to-integer type coercion, confirming extraction of admin email addresses and password hashes. The same concatenation pattern also affects plugin-field-sort/src/server/sort-field.ts:124. Patch version 2.0.39 (released 2026-04-17) replaces concatenation with parameterized queries using bind parameters.

Affected products

  • NocoBase @nocobase/database <=2.0.32

Identifiers

  • CVE-2026-41640
  • GHSA-4948-f92q-f432

Timeline

  • 2026-04-22: disclosed: Public disclosure via GitHub Advisory GHSA-4948-f92q-f432
  • 2026-04-17: patched: Fix merged in PR #9133, patched version 2.0.39 released
  • 2026-04-18: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.