Quick answers
- Is This vulnerability exploited in the wild?
- No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
- How severe is This vulnerability?
- Low severity, with a CVSS score of 0, published 10 April 2026.
- Which products and versions are affected?
- Saltcorn < 1.4.5, >= 1.5.0 < 1.5.5, >= 1.6.0-alpha.0 < 1.6.0-beta.4.
- Is there a fix for This vulnerability?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is This vulnerability attacked?
- It is attacked over the network, in a software library.
- Am I affected?
- Check whether you run Saltcorn at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A SQL injection vulnerability exists in the `jsexprToSQL()` function within `@saltcorn/data`. The `Literal` handler in `packages/saltcorn-data/models/expression.ts` fails to escape single quotes when converting JavaScript string literals into SQL for database CHECK constraints. An attacker with sufficient privileges to create or modify table constraints can provide a crafted JavaScript expression (e.g., using a payload like `'; DROP TABLE users; --`) that breaks out of the SQL string context. This results in arbitrary SQL execution during the `ALTER TABLE` operation. The issue is fixed in versions 1.4.5, 1.5.5, and 1.6.0-beta.4.
Affected products
- Saltcorn @saltcorn/data < 1.4.5, >= 1.5.0 < 1.5.5, >= 1.6.0-alpha.0 < 1.6.0-beta.4
Timeline
- 2026-04-09: disclosed: Vulnerability reported to Saltcorn maintainers.
- 2026-04-10: advisory: GitHub Advisory GHSA-59xv-588h-2vmm published.