Saltcorn @saltcorn/data SQL injection in jsexprToSQL Literal Handler

Executive brief

Saltcorn is an open-source no-code platform used to build web applications and databases. A security flaw in how it handles database constraints allows an administrative user to execute unauthorized database commands. This could lead to the deletion of tables, theft of sensitive user data, or full control over the underlying database.

Technical details

A SQL injection vulnerability exists in the `jsexprToSQL()` function within `@saltcorn/data`. The `Literal` handler in `packages/saltcorn-data/models/expression.ts` fails to escape single quotes when converting JavaScript string literals into SQL for database CHECK constraints. An attacker with sufficient privileges to create or modify table constraints can provide a crafted JavaScript expression (e.g., using a payload like `'; DROP TABLE users; --`) that breaks out of the SQL string context. This results in arbitrary SQL execution during the `ALTER TABLE` operation. The issue is fixed in versions 1.4.5, 1.5.5, and 1.6.0-beta.4.

Affected products

• Saltcorn @saltcorn/data < 1.4.5, >= 1.5.0 < 1.5.5, >= 1.6.0-alpha.0 < 1.6.0-beta.4

Timeline

• 2026-04-09: disclosed: Vulnerability reported to Saltcorn maintainers.
• 2026-04-10: advisory: GitHub Advisory GHSA-59xv-588h-2vmm published.

References

• https://api.github.com/users/zulloper
• https://github.com/zulloper
• https://api.github.com/users/zulloper/gists%7B/gist_id%7D
• https://api.github.com/users/zulloper/repos
• https://avatars.githubusercontent.com/u/47581381?v=4
• https://api.github.com/users/zulloper/events%7B/privacy%7D