Nocobase vulnerabilities

Products

• Nocobase 12

Newest

• nocobase NocoBase plugin-collection-sql through 2.2.28 SQL Injection via sqlCollection:setFields CVE-2026-112306 8.6 HighOctober 19, 2026
• nocobase NocoBase Rich Text Field Stored Cross-Site Scripting via API CVE-2026-84701 5.1 MediumSeptember 2, 2026
• nocobase NocoBase backup restore schema name allows command injection CVE-2026-55410 Fix available 6.7 MediumJuly 15, 2026
• nocobase NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE CVE-2026-52887 Public exploitFix available 10.0 CriticalJuly 15, 2026
• nocobase NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass CVE-2026-52888 Fix available 6.8 MediumJuly 15, 2026
• nocobase NocoBase 2.1.20 Server-Side Request Forgery via serverRequest wrapper CVE-2026-58468 5.1 MediumJuly 7, 2026
• nocobase NocoBase Vulnerable to SQL Injection via String Concatenation in Recursive Eager Loading CVE-2026-41640 Fix available 7.5 HighApril 22, 2026
• nocobase NocoBase Vulnerable to SQL Validation Bypass via `sqlCollection:update` Missing `checkSQL` Call CVE-2026-41641 Fix available 7.2 HighApril 22, 2026
• nocobase, nocobase @nocobase/plugin-workflow-request +1 more NocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins CVE-2026-40346 Fix available 6.4 MediumApril 15, 2026
• nocobase plugin-workflow-javascript nocobase plugin-workflow-javascript Vm.js createSafeConsole sandbox CVE-2026-6224 6.9 MediumApril 13, 2026
• nocobase NocoBase Has SQL Injection via template variable substitution in workflow SQL node CVE-2026-34825 Fix available 8.5 HighApril 1, 2026
• nocobase NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node CVE-2026-34156 Public exploitFix available EPSS 35.0% 10.0 CriticalMarch 30, 2026
• nocobase nocobase JWT Service jwt-service.ts hard-coded key CVE-2025-13877 Fix available 6.3 MediumDecember 2, 2025