Executive brief
NocoDB's SQL collection plugin allows administrators to create collections backed by SQL queries. A vulnerability in the update endpoint fails to validate SQL statements, allowing an authenticated user with collection management permissions to inject arbitrary SQL—including database file reads and lateral movement commands—after creating a benign collection. This enables exfiltration of sensitive database content and potential privilege escalation.
Technical details
The vulnerability is a missing input validation (CWE-89 SQL Injection, CWE-284 Improper Access Control) in the `sqlCollection:update` endpoint. The `checkSQL()` function blocks dangerous keywords (pg_read_file, LOAD_FILE, dblink, etc.) and enforces SELECT/WITH-SELECT-only queries on the `collections:create` and `sqlCollection:execute` endpoints, but is entirely absent from the `sqlCollection:update` handler. An attacker with collection management permissions can (1) create a collection with benign SQL that passes validation, then (2) update it with arbitrary SQL that bypasses all keyword and statement-type checks, and (3) query the collection to execute the injected SQL. The attack requires collection management permissions (pm.data-source-manager.collection-sql); the update endpoint is network-accessible. Fix: add the checkSQL() call to the update action (available in patch version 2.0.39+).
Affected products
- NocoDB plugin-collection-sql <= 2.0.38
Timeline
- 2026-04-18: disclosed
- 2026-04-22: patched: Version 2.0.39 includes fix