Executive brief
Saltcorn is a no-code application builder that allows administrators to create database constraints using JavaScript expressions. A flaw in how the application converts these expressions to SQL allows an authenticated admin to inject malicious SQL code by including unescaped quotes in constraint formulas. This could lead to unauthorized database modifications, data deletion, or exposure of sensitive information without requiring additional user interaction.
Technical details
The vulnerability is a SQL injection (CWE-89) in the Literal handler of jsexprToSQL() in packages/saltcorn-data/models/expression.ts (lines 117-118). When processing Formula-type constraints, string values are wrapped in single quotes without escaping embedded quotes, allowing breakout and injection of arbitrary SQL operators and commands. The attack chain flows from table constraint creation → jsexprToSQL() → db.query() executing unsanitized SQL via ALTER TABLE CHECK constraints. Attack preconditions require high-privilege access (authenticated admin creating constraints), but no user interaction beyond constraint submission. An attacker with these privileges can achieve arbitrary SQL execution, including DROP TABLE, data exfiltration via error-based injection, and database schema manipulation. The fix (released in versions 1.4.5, 1.5.5, and 1.6.0-beta.4) escapes single quotes by replacing ' with '' per SQL standard.
Affected products
- Saltcorn @saltcorn/data <1.4.5, 1.5.0
Timeline
- 2026-04-10: disclosed: GHSA-59xv-588h-2vmm published
- 2026-04-10: patched: Patches released in versions 1.4.5, 1.5.5, and 1.6.0-beta.4