CVE-2026-41640

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-41640", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-21T23:58:43.801Z", "datePublished": "2026-05-07T04:09:59.264Z", "dateUpdated": "2026-05-07T12:55:04.738Z"}, "containers": {"cna": {"title": "NocoBase Vulnerable to SQL Injection via String Concatenation in Recursive Eager Loading", "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "lang": "en", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/nocobase/nocobase/security/advisories/GHSA-4948-f92q-f432", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nocobase/nocobase/security/advisories/GHSA-4948-f92q-f432"}, {"name": "https://github.com/nocobase/nocobase/pull/9133", "tags": ["x_refsource_MISC"], "url": "https://github.com/nocobase/nocobase/pull/9133"}, {"name": "https://github.com/nocobase/nocobase/commit/202e2b8efe44ba90adbf1087f6f70881ff947604", "tags": ["x_refsource_MISC"], "url": "https://github.com/nocobase/nocobase/commit/202e2b8efe44ba90adbf1087f6f70881ff947604"}, {"name": "https://github.com/nocobase/nocobase/releases/tag/v2.0.39", "tags": ["x_refsource_MISC"], "url": "https://github.com/nocobase/nocobase/releases/tag/v2.0.39"}], "affected": [{"vendor": "nocobase", "product": "nocobase", "versions": [{"version": "< 2.0.39", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-07T04:09:59.264Z"}, "descriptions": [{"lang": "en", "value": "NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.39, the queryParentSQL() function in the core database package constructs a recursive CTE query by joining nodeIds with string concatenation instead of using parameterized queries. The nodeIds array contains primary key values read from database rows. An attacker who can create a record with a malicious string primary key can inject arbitrary SQL when any subsequent request triggers recursive eager loading on that collection. This issue has been patched in version 2.0.39."}], "source": {"advisory": "GHSA-4948-f92q-f432", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/nocobase/nocobase/security/advisories/GHSA-4948-f92q-f432", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-07T12:54:23.331234Z", "id": "CVE-2026-41640", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-07T12:55:04.738Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-41640", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-07T12:54:23.331234Z"}}}], "references": [{"url": "https://github.com/nocobase/nocobase/security/advisories/GHSA-4948-f92q-f432", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-07T12:54:58.504Z"}}], "cna": {"title": "NocoBase Vulnerable to SQL Injection via String Concatenation in Recursive Eager Loading", "source": {"advisory": "GHSA-4948-f92q-f432", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "nocobase", "product": "nocobase", "versions": [{"status": "affected", "version": "< 2.0.39"}]}], "references": [{"url": "https://github.com/nocobase/nocobase/security/advisories/GHSA-4948-f92q-f432", "name": "https://github.com/nocobase/nocobase/security/advisories/GHSA-4948-f92q-f432", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/nocobase/nocobase/pull/9133", "name": "https://github.com/nocobase/nocobase/pull/9133", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nocobase/nocobase/commit/202e2b8efe44ba90adbf1087f6f70881ff947604", "name": "https://github.com/nocobase/nocobase/commit/202e2b8efe44ba90adbf1087f6f70881ff947604", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nocobase/nocobase/releases/tag/v2.0.39", "name": "https://github.com/nocobase/nocobase/releases/tag/v2.0.39", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.39, the queryParentSQL() function in the core database package constructs a recursive CTE query by joining nodeIds with string concatenation instead of using parameterized queries. The nodeIds array contains primary key values read from database rows. An attacker who can create a record with a malicious string primary key can inject arbitrary SQL when any subsequent request triggers recursive eager loading on that collection. This issue has been patched in version 2.0.39."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-07T04:09:59.264Z"}}}, "cveMetadata": {"cveId": "CVE-2026-41640", "state": "PUBLISHED", "dateUpdated": "2026-05-07T12:55:04.738Z", "dateReserved": "2026-04-21T23:58:43.801Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-07T04:09:59.264Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "nocobase", "vendor": "nocobase", "versions": [{"status": "affected", "version": "< 2.0.39"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nocobase:nocobase:*:*:*:*:*:*:*:*", "matchCriteriaId": "353FCC5B-0DF7-49FC-9E2B-FD04C3A46751", "versionEndExcluding": "2.0.39", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.39, the queryParentSQL() function in the core database package constructs a recursive CTE query by joining nodeIds with string concatenation instead of using parameterized queries. The nodeIds array contains primary key values read from database rows. An attacker who can create a record with a malicious string primary key can inject arbitrary SQL when any subsequent request triggers recursive eager loading on that collection. This issue has been patched in version 2.0.39."}, {"lang": "es", "value": "NocoBase es una plataforma no-code/low-code impulsada por IA para construir aplicaciones de negocio y soluciones empresariales. Antes de la versi\u00f3n 2.0.39, la funci\u00f3n queryParentSQL() en el paquete de la base de datos central construye una consulta CTE recursiva uniendo nodeIds con concatenaci\u00f3n de cadenas en lugar de usar consultas parametrizadas. El array nodeIds contiene valores de clave primaria le\u00eddos de las filas de la base de datos. Un atacante que puede crear un registro con una clave primaria de cadena maliciosa puede inyectar SQL arbitrario cuando cualquier solicitud subsiguiente activa la carga ansiosa recursiva en esa colecci\u00f3n. Este problema ha sido parcheado en la versi\u00f3n 2.0.39."}], "id": "CVE-2026-41640", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41640", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-05-07T12:54:23.331234Z", "version": "2.0.3"}}]}, "published": "2026-05-07T04:16:28.277", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/nocobase/nocobase/commit/202e2b8efe44ba90adbf1087f6f70881ff947604"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/nocobase/nocobase/pull/9133"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Release Notes"], "url": "https://github.com/nocobase/nocobase/releases/tag/v2.0.39"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/nocobase/nocobase/security/advisories/GHSA-4948-f92q-f432"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/nocobase/nocobase/security/advisories/GHSA-4948-f92q-f432"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.0.39)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "nocobase", "source": "cna", "vendor": "nocobase"}, "product": "nocobase", "vendor": "nocobase"}], "created": "2026-05-07T05:30:22.198187+00:00", "updated": "2026-06-18T08:30:04.525786+00:00", "vendors": ["nocobase", "nocobase$PRODUCT$nocobase"]}