Nocobase
Monthly
SQL injection in NocoBase v2.1.21 lets an attacker reach the SQL handling path behind the checkSQL function and submit crafted SQL statements that disclose sensitive database contents. Publicly available exploit code exists (SSVC Exploitation: poc, Automatable: yes, Technical Impact: total), though the EPSS score is only 0.15% (5th percentile) and CVE-2026-88402 is not confirmed actively exploited (CISA KEV). The published CVSS vector is 9.8 with PR:N/UI:N, but independent assessment rates the vector lower (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) and concludes that the SQL data-source/SQL-collection feature is normally an authenticated administrative capability, so the realistic limiting factor is a valid account with permission to define or run SQL sources rather than an unauthenticated remote attacker; this discrepancy should be confirmed with the vendor.
SQL injection in NocoBase's @nocobase/plugin-notification-in-app-message (before 2.0.61) lets any signed-up authenticated user reach GET /api/myInAppChannels:list and inject into the filter[latestMsgReceiveTimestamp][$lt] parameter, which is concatenated into a Sequelize.literal() template with no escaping or parameter binding. Because PostgreSQL permits stacked statements through this sink, an attacker can run arbitrary SQL and escalate to operating-system command execution via COPY ... TO PROGRAM. No public exploit identified at time of analysis and the flaw is not in CISA KEV, but the code fix and regression tests are public in the vendor commit, and the vendor rates it CVSS 10.0.
Server-side request forgery in NocoBase v2.1.21 lets an authenticated, low-privilege user drive the server's serverRequest function to issue outbound HTTP requests to arbitrary destinations, enabling internal reachability scanning and probing of services that are not exposed externally. Because exploitation requires a valid low-privilege account (per the CVSS vector PR:L) and the value of the attack depends on the NocoBase host having network access to internal-only resources, the practical impact is internal reconnaissance and reachability enumeration, with fuller information disclosure only where serverRequest returns response bodies to the caller. No public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and EPSS is low (0.18%, 8th percentile), so near-term mass exploitation is unlikely; the vendor scored this 6.5 (C:H) while our independent assessment rates confidentiality impact lower (5.0, C:L).
Command injection in NocoBase's @nocobase/plugin-backups prior to v2.1.19 allows an authenticated backup-management user to execute arbitrary OS commands as the NocoBase server process by restoring a crafted backup archive. The database.schema field from a backup's _metadata.json is interpolated directly into a shell command string passed to Node.js child_process.exec(), a classic CWE-78 pattern that bypasses any sanitization at the shell level. No active exploitation confirmed (not in CISA KEV) and no public exploit identified at time of analysis, but the commit diff confirms the mechanism is straightforward and the fix is available in v2.1.19.
PostgreSQL password hash disclosure in NocoBase 2.0.59 and earlier allows an authenticated administrator to extract pg_shadow credential hashes and database metadata by submitting raw SQL queries that reference system catalog tables omitted from the checkSQL() keyword blacklist. The SQL Collection plugin's blocklist-based validation failed to restrict pg_shadow, pg_roles, pg_stat_activity, and information_schema, and the commit diff confirms the bypass also worked via subquery wrapping (e.g., SELECT * FROM (SELECT usename, passwd FROM pg_shadow) AS passwords). No public exploit identified at time of analysis, and this CVE is not listed in CISA KEV; a vendor-released patch is available in v2.1.0-alpha.46.
Server-side request forgery in NocoBase through v2.1.20 allows authenticated administrators to issue arbitrary outbound HTTP requests via the serverRequest wrapper, enabling internal network enumeration and cloud instance metadata exfiltration. The attack surface spans workflow request nodes, custom request action buttons, and the AI plugin - all of which accept administrator-supplied URLs without adequate server-side validation. A publicly available proof-of-concept exists per VulnCheck reporting; no CISA KEV listing is present, indicating no confirmed widespread active exploitation at time of analysis, though the IAM credential theft potential elevates real-world impact significantly for cloud-hosted deployments.
Sandbox escape in NocoBase's plugin-workflow-javascript (all 2.0.x releases through 2.0.23) originates from a defective `createSafeConsole` implementation in the server-side `Vm.js` file, enabling remote attackers to break out of the JavaScript VM execution boundary and interact with the host Node.js process. A public proof-of-concept exploit has been released and documented on GitHub, and SSVC analysis classifies the attack vector as automatable. Despite the available PoC, EPSS probability sits at just 0.04% (12th percentile) and the vulnerability is not listed in CISA KEV, indicating limited observed exploitation activity at time of analysis.
SQL injection in NocoBase v2.1.21 lets an attacker reach the SQL handling path behind the checkSQL function and submit crafted SQL statements that disclose sensitive database contents. Publicly available exploit code exists (SSVC Exploitation: poc, Automatable: yes, Technical Impact: total), though the EPSS score is only 0.15% (5th percentile) and CVE-2026-88402 is not confirmed actively exploited (CISA KEV). The published CVSS vector is 9.8 with PR:N/UI:N, but independent assessment rates the vector lower (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) and concludes that the SQL data-source/SQL-collection feature is normally an authenticated administrative capability, so the realistic limiting factor is a valid account with permission to define or run SQL sources rather than an unauthenticated remote attacker; this discrepancy should be confirmed with the vendor.
SQL injection in NocoBase's @nocobase/plugin-notification-in-app-message (before 2.0.61) lets any signed-up authenticated user reach GET /api/myInAppChannels:list and inject into the filter[latestMsgReceiveTimestamp][$lt] parameter, which is concatenated into a Sequelize.literal() template with no escaping or parameter binding. Because PostgreSQL permits stacked statements through this sink, an attacker can run arbitrary SQL and escalate to operating-system command execution via COPY ... TO PROGRAM. No public exploit identified at time of analysis and the flaw is not in CISA KEV, but the code fix and regression tests are public in the vendor commit, and the vendor rates it CVSS 10.0.
Server-side request forgery in NocoBase v2.1.21 lets an authenticated, low-privilege user drive the server's serverRequest function to issue outbound HTTP requests to arbitrary destinations, enabling internal reachability scanning and probing of services that are not exposed externally. Because exploitation requires a valid low-privilege account (per the CVSS vector PR:L) and the value of the attack depends on the NocoBase host having network access to internal-only resources, the practical impact is internal reconnaissance and reachability enumeration, with fuller information disclosure only where serverRequest returns response bodies to the caller. No public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and EPSS is low (0.18%, 8th percentile), so near-term mass exploitation is unlikely; the vendor scored this 6.5 (C:H) while our independent assessment rates confidentiality impact lower (5.0, C:L).
Command injection in NocoBase's @nocobase/plugin-backups prior to v2.1.19 allows an authenticated backup-management user to execute arbitrary OS commands as the NocoBase server process by restoring a crafted backup archive. The database.schema field from a backup's _metadata.json is interpolated directly into a shell command string passed to Node.js child_process.exec(), a classic CWE-78 pattern that bypasses any sanitization at the shell level. No active exploitation confirmed (not in CISA KEV) and no public exploit identified at time of analysis, but the commit diff confirms the mechanism is straightforward and the fix is available in v2.1.19.
PostgreSQL password hash disclosure in NocoBase 2.0.59 and earlier allows an authenticated administrator to extract pg_shadow credential hashes and database metadata by submitting raw SQL queries that reference system catalog tables omitted from the checkSQL() keyword blacklist. The SQL Collection plugin's blocklist-based validation failed to restrict pg_shadow, pg_roles, pg_stat_activity, and information_schema, and the commit diff confirms the bypass also worked via subquery wrapping (e.g., SELECT * FROM (SELECT usename, passwd FROM pg_shadow) AS passwords). No public exploit identified at time of analysis, and this CVE is not listed in CISA KEV; a vendor-released patch is available in v2.1.0-alpha.46.
Server-side request forgery in NocoBase through v2.1.20 allows authenticated administrators to issue arbitrary outbound HTTP requests via the serverRequest wrapper, enabling internal network enumeration and cloud instance metadata exfiltration. The attack surface spans workflow request nodes, custom request action buttons, and the AI plugin - all of which accept administrator-supplied URLs without adequate server-side validation. A publicly available proof-of-concept exists per VulnCheck reporting; no CISA KEV listing is present, indicating no confirmed widespread active exploitation at time of analysis, though the IAM credential theft potential elevates real-world impact significantly for cloud-hosted deployments.
Sandbox escape in NocoBase's plugin-workflow-javascript (all 2.0.x releases through 2.0.23) originates from a defective `createSafeConsole` implementation in the server-side `Vm.js` file, enabling remote attackers to break out of the JavaScript VM execution boundary and interact with the host Node.js process. A public proof-of-concept exploit has been released and documented on GitHub, and SSVC analysis classifies the attack vector as automatable. Despite the available PoC, EPSS probability sits at just 0.04% (12th percentile) and the vulnerability is not listed in CISA KEV, indicating limited observed exploitation activity at time of analysis.