CVE-2026-41641

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-41641", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-21T23:58:43.801Z", "datePublished": "2026-05-07T04:13:33.609Z", "dateUpdated": "2026-05-07T14:14:23.539Z"}, "containers": {"cna": {"title": "NocoBase Vulnerable to SQL Validation Bypass via `sqlCollection:update` Missing `checkSQL` Call", "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "lang": "en", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-284", "lang": "en", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/nocobase/nocobase/security/advisories/GHSA-wrwh-c28m-9jjh", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nocobase/nocobase/security/advisories/GHSA-wrwh-c28m-9jjh"}, {"name": "https://github.com/nocobase/nocobase/pull/9134", "tags": ["x_refsource_MISC"], "url": "https://github.com/nocobase/nocobase/pull/9134"}, {"name": "https://github.com/nocobase/nocobase/commit/851aee543efa894142e0f7be03eb55d9cec06a91", "tags": ["x_refsource_MISC"], "url": "https://github.com/nocobase/nocobase/commit/851aee543efa894142e0f7be03eb55d9cec06a91"}, {"name": "https://github.com/nocobase/nocobase/releases/tag/v2.0.39", "tags": ["x_refsource_MISC"], "url": "https://github.com/nocobase/nocobase/releases/tag/v2.0.39"}], "affected": [{"vendor": "nocobase", "product": "nocobase", "versions": [{"version": "< 2.0.39", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-07T04:13:33.609Z"}, "descriptions": [{"lang": "en", "value": "NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.39, the checkSQL() validation function that blocks dangerous SQL keywords (e.g., pg_read_file, LOAD_FILE, dblink) is applied on the collections:create and sqlCollection:execute endpoints but is entirely missing on the sqlCollection:update endpoint. An attacker with collection management permissions can create a SQL collection with benign SQL, then update it with arbitrary SQL that bypasses all validation, and query the collection to execute the injected SQL and exfiltrate data. This issue has been patched in version 2.0.39."}], "source": {"advisory": "GHSA-wrwh-c28m-9jjh", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/nocobase/nocobase/security/advisories/GHSA-wrwh-c28m-9jjh", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-07T14:13:49.780425Z", "id": "CVE-2026-41641", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-07T14:14:23.539Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-41641", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-07T14:13:49.780425Z"}}}], "references": [{"url": "https://github.com/nocobase/nocobase/security/advisories/GHSA-wrwh-c28m-9jjh", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-07T14:14:17.766Z"}}], "cna": {"title": "NocoBase Vulnerable to SQL Validation Bypass via `sqlCollection:update` Missing `checkSQL` Call", "source": {"advisory": "GHSA-wrwh-c28m-9jjh", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "nocobase", "product": "nocobase", "versions": [{"status": "affected", "version": "< 2.0.39"}]}], "references": [{"url": "https://github.com/nocobase/nocobase/security/advisories/GHSA-wrwh-c28m-9jjh", "name": "https://github.com/nocobase/nocobase/security/advisories/GHSA-wrwh-c28m-9jjh", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/nocobase/nocobase/pull/9134", "name": "https://github.com/nocobase/nocobase/pull/9134", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nocobase/nocobase/commit/851aee543efa894142e0f7be03eb55d9cec06a91", "name": "https://github.com/nocobase/nocobase/commit/851aee543efa894142e0f7be03eb55d9cec06a91", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nocobase/nocobase/releases/tag/v2.0.39", "name": "https://github.com/nocobase/nocobase/releases/tag/v2.0.39", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.39, the checkSQL() validation function that blocks dangerous SQL keywords (e.g., pg_read_file, LOAD_FILE, dblink) is applied on the collections:create and sqlCollection:execute endpoints but is entirely missing on the sqlCollection:update endpoint. An attacker with collection management permissions can create a SQL collection with benign SQL, then update it with arbitrary SQL that bypasses all validation, and query the collection to execute the injected SQL and exfiltrate data. This issue has been patched in version 2.0.39."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-07T04:13:33.609Z"}}}, "cveMetadata": {"cveId": "CVE-2026-41641", "state": "PUBLISHED", "dateUpdated": "2026-05-07T14:14:23.539Z", "dateReserved": "2026-04-21T23:58:43.801Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-07T04:13:33.609Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "nocobase", "vendor": "nocobase", "versions": [{"status": "affected", "version": "< 2.0.39"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nocobase:nocobase:*:*:*:*:*:*:*:*", "matchCriteriaId": "353FCC5B-0DF7-49FC-9E2B-FD04C3A46751", "versionEndExcluding": "2.0.39", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.39, the checkSQL() validation function that blocks dangerous SQL keywords (e.g., pg_read_file, LOAD_FILE, dblink) is applied on the collections:create and sqlCollection:execute endpoints but is entirely missing on the sqlCollection:update endpoint. An attacker with collection management permissions can create a SQL collection with benign SQL, then update it with arbitrary SQL that bypasses all validation, and query the collection to execute the injected SQL and exfiltrate data. This issue has been patched in version 2.0.39."}, {"lang": "es", "value": "NocoBase es una plataforma no-code/low-code impulsada por IA para construir aplicaciones de negocio y soluciones empresariales. Antes de la versi\u00f3n 2.0.39, la funci\u00f3n de validaci\u00f3n checkSQL() que bloquea palabras clave SQL peligrosas (p. ej., pg_read_file, LOAD_FILE, dblink) se aplica en los endpoints collections:create y sqlCollection:execute, pero est\u00e1 completamente ausente en el endpoint sqlCollection:update. Un atacante con permisos de gesti\u00f3n de colecciones puede crear una colecci\u00f3n SQL con SQL benigno, luego actualizarla con SQL arbitrario que omite toda validaci\u00f3n, y consultar la colecci\u00f3n para ejecutar el SQL inyectado y exfiltrar datos. Este problema ha sido parcheado en la versi\u00f3n 2.0.39."}], "id": "CVE-2026-41641", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41641", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-05-07T14:13:49.780425Z", "version": "2.0.3"}}]}, "published": "2026-05-07T06:16:05.073", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/nocobase/nocobase/commit/851aee543efa894142e0f7be03eb55d9cec06a91"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/nocobase/nocobase/pull/9134"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Product"], "url": "https://github.com/nocobase/nocobase/releases/tag/v2.0.39"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/nocobase/nocobase/security/advisories/GHSA-wrwh-c28m-9jjh"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/nocobase/nocobase/security/advisories/GHSA-wrwh-c28m-9jjh"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}, {"lang": "en", "value": "CWE-284"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.0.39)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "nocobase", "source": "cna", "vendor": "nocobase"}, "product": "nocobase", "vendor": "nocobase"}], "created": "2026-05-07T06:30:05.931744+00:00", "updated": "2026-06-18T08:30:04.525476+00:00", "vendors": ["nocobase", "nocobase$PRODUCT$nocobase"]}