Executive brief
NocoBase is a low-code database platform used to build business applications. The core database module contains a SQL injection vulnerability in its recursive tree data loading feature. An attacker with permission to create records in a tree-structured collection can inject arbitrary SQL by crafting a malicious primary key value, allowing them to extract sensitive data (user credentials, password hashes) or potentially execute operating system commands on the database server.
Technical details
The vulnerability exists in the queryParentSQL() function (packages/core/database/src/eager-loading-tree.ts:59-84), which builds a recursive CTE query using string concatenation of nodeIds array values rather than parameterized queries. The nodeIds are sourced from database rows read during eager loading of BelongsTo associations with recursively: true flag. An attacker who can create a record with a crafted string primary key containing SQL metacharacters can break out of the WHERE clause and inject additional UNION ALL branches or subqueries. The attack is triggered when any subsequent request performs recursive eager loading on that collection. Proof-of-concept demonstrates error-based data extraction using CAST-to-integer type coercion, confirming extraction of admin email addresses and password hashes. The same concatenation pattern also affects plugin-field-sort/src/server/sort-field.ts:124. Patch version 2.0.39 (released 2026-04-17) replaces concatenation with parameterized queries using bind parameters.
Affected products
- NocoBase @nocobase/database <=2.0.32
Timeline
- 2026-04-22: disclosed: Public disclosure via GitHub Advisory GHSA-4948-f92q-f432
- 2026-04-17: patched: Fix merged in PR #9133, patched version 2.0.39 released
- 2026-04-18: advisory