Executive brief
NocoBase is a low-code database platform that allows users to build databases and applications. A SQL injection vulnerability in the checkSQL validation function allows authenticated attackers to bypass safety checks and execute arbitrary SQL statements, potentially exposing, modifying, or deleting sensitive database information. The flaw exploits multi-statement SQL execution to hide dangerous keywords from validation checks.
Technical details
The checkSQL function in @nocobase/plugin-collection-sql splits input SQL by semicolons and validates only the first statement, allowing subsequent statements to bypass keyword filtering. Combined with hardcoded multipleStatements: true in MySQL/MariaDB dialects, authenticated attackers can inject DROP, DELETE, UPDATE, or other dangerous SQL commands after a valid SELECT statement to achieve arbitrary database operations including data exfiltration, modification, or deletion.
Affected products
- NocoBase NocoBase 2.1.21
Timeline
- 2026-09-07: disclosed: Vulnerability reported in GitHub issue
- 2026-09-21: advisory: CVE-2026-88402 published