EUVD-2026-25633
GHSA-jp74-mfrx-3qvh
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable, low-complexity injection needing only a low-privilege authenticated account (PR:L); total DB impact, but injection stays within the app's own database scope (S:U).
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
7Blast Radius
ecosystem impact- 2 npm packages depend on @saltcorn/server (2 direct, 0 indirect)
Ecosystem-wide dependent count for version 1.5.0-beta.0.
DescriptionGitHub Advisory
Saltcorn is an extensible, open source, no-code database application builder. Prior to 1.4.6, 1.5.6, and 1.6.0-beta.5, a SQL injection vulnerability in Saltcorn’s mobile-sync routes allows any authenticated low-privilege user with read access to at least one table to inject arbitrary SQL through sync parameters. This can lead to full database exfiltration, including admin password hashes and configuration secrets, and may also enable database modification or destruction depending on the backend. This vulnerability is fixed in 1.4.6, 1.5.6, and 1.6.0-beta.5.
AnalysisAI
SQL injection in Saltcorn's mobile-sync routes lets any authenticated low-privilege user with read access to a single table inject arbitrary SQL via the POST /sync/load_changes and POST /sync/deletes endpoints, enabling full database exfiltration of admin password hashes and configuration secrets and potentially data modification or destruction. It affects Saltcorn releases before 1.4.6, before 1.5.6, and before 1.6.0-beta.5. Publicly available exploit code exists (the GHSA advisory documents a working PoC and SSVC rates exploitation as 'poc'), though EPSS probability is very low at 0.03%.
Technical ContextAI
Saltcorn is an extensible open-source no-code database application builder (npm package @saltcorn/server) that ships a mobile synchronization feature. The flaw is a classic CWE-89 SQL Injection: in packages/server/routes/sync.js, user-controlled request-body values are interpolated directly into SQL template literals rather than passed as bound parameters. Specifically, req.body.syncInfos[tableName].maxLoadedId is concatenated into query fragments in getSyncRows() (e.g. data_tbl."<pk>" > ${syncInfo.maxLoadedId} and info_tbl.ref > ${syncInfo.maxLoadedId}), and timestamp-derived request values are similarly interpolated in getDelRows(). The code applies db.sqlsanitize() only to identifiers such as the primary-key name, which does not sanitize interpolated values, and performs no parseInt()/numeric validation or prepared-statement binding before concatenation, allowing an attacker to break out of the intended query and execute arbitrary SQL in the application database context.
RemediationAI
Vendor-released patch: upgrade to Saltcorn 1.4.6, 1.5.6, or 1.6.0-beta.5, whichever matches your release line (per the vendor advisory GHSA-jp74-mfrx-3qvh, https://github.com/saltcorn/saltcorn/security/advisories/GHSA-jp74-mfrx-3qvh, where the sync parameters are properly bound/validated). Until patching, reduce exposure by restricting or disabling the mobile-sync feature and blocking or access-controlling the POST /sync/load_changes and POST /sync/deletes routes at a reverse proxy (trade-off: mobile app synchronization will stop working); tighten account provisioning by disabling self-registration and auditing low-privilege accounts, since any authenticated user with read access to one table can exploit this; and if using PostgreSQL, ensure the application database role has least privilege (no unnecessary write/DDL rights) to limit the modification/destruction impact, accepting that this does not stop confidentiality loss. Do not rely on db.sqlsanitize() as a mitigation - it protects identifiers, not injected values.
Path traversal in Saltcorn's mobile sync endpoints enables remote unauthenticated attackers to write arbitrary JSON file
Open redirect in Saltcorn's post-login destination parameter validation allows attackers to redirect authenticated users
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today