7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41640

CVE-2026-41640: NocoBase Vulnerable to SQL Injection via String Concatenation in Recursive Eager Loading

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.39, the queryParentSQL() function in the core database package constructs a recursive CTE query by joining nodeIds with string concatenation instead of using parameterized queries. The nodeIds array contains primary key values read from database rows. An attacker who can create a record with a malicious string primary key can inject arbitrary SQL when any subsequent request triggers recursive eager loading on that collection. This issue has been patched in version 2.0.39.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41640

CVE-2026-41640:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@nocobase/database	npm	< 2.0.39	2.0.39

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided patch reveals two instances of a classic SQL injection vulnerability (CWE-89) within the NocoBase application. The root cause in both cases is the unsafe construction of SQL queries using template literals and string concatenation with user-controllable data, instead of using parameterized queries (prepared statements).

The first vulnerable function, queryParentSQL, is located in the core database package. It is used for recursive eager loading of tree structures. The nodeIds, which are primary keys and can be controlled by an attacker with record-creation permissions, are directly embedded into the SQL query. The patch remediates this by replacing the string concatenation with bind parameters ($1, $2, etc.), ensuring the database driver properly handles the input and prevents injection.
The second vulnerable function is SortField.init within the plugin-field-sort package. A similar injection pattern exists when initializing sort values for a scoped field. The scopeValue is concatenated directly into the WHERE clause. The patch applies the same fix, using bind parameters to safely include the scopeValue in the query.

Both functions are critical because they allow an attacker with low-level privileges (the ability to create records) to execute arbitrary SQL queries. As demonstrated in the proof-of-concept, this can lead to the exfiltration of sensitive data, such as user credentials, from the database.

Vulnerable functions

queryParentSQL

packages/core/database/src/eager-loading/eager-loading-tree.ts

The function `queryParentSQL` is vulnerable to SQL injection because it constructs a raw SQL query by concatenating the `nodeIds` array directly into the query string. An attacker who can control the values of `nodeIds` (by creating records with specially crafted primary keys) can inject arbitrary SQL into the `IN` clause of the recursive CTE.

SortField.init

packages/plugins/@nocobase/plugin-field-sort/src/server/sort-field.ts

The `init` method of the `SortField` class contains an inner function that builds a SQL query for initializing sort values. This function is vulnerable to SQL injection because it concatenates `filteredScopeValue` directly into the `IN` clause of the `WHERE` statement. An attacker can control these values through the `scopeKey` of the sort field, leading to arbitrary SQL execution.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.