CVE-2026-34825: 
JavaScript vulnerability analysis and mitigation

CVE-2026-34825 is a SQL injection vulnerability in the NocoBase plugin-workflow-sql package (@nocobase/plugin-workflow-sql) affecting all versions through 2.0.29. The flaw allows any high-privileged user who can trigger a workflow containing a SQL node with user-controlled template variables to inject arbitrary SQL commands. It was disclosed on April 1, 2026, and patched in version 2.0.30. The vulnerability carries a CVSS v3.1 base score of 6.5 (High) and a CVSS v4.0 base score of 8.5 (High) (GitHub Advisory).

The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). In SQLInstruction.ts (line 28), the getParsedValue() function performs simple string substitution of {{$context.data.fieldName}} placeholders with values from workflow trigger data — without any escaping, quoting, or parameterized binding — before passing the resulting string directly to sequelize.query(). An attacker who controls a field referenced in a SQL node template (e.g., a user's nickname field) can break out of the string literal context and inject arbitrary SQL. The attack is network-based, requires no user interaction, but does require high privileges (the ability to trigger a workflow or create records that trigger one) (GitHub Advisory, NocoBase Security Advisory).

Successful exploitation grants full database read and write access through the injected SQL. An attacker can extract credentials and sensitive records, modify or delete data, or drop tables entirely. In the default Docker deployment, the database user runs with superuser privileges, meaning the blast radius extends to full database compromise. Confidentiality and integrity are both rated High impact, while availability is unaffected by the injection itself (GitHub Advisory, NocoBase Security Advisory).

A detailed proof-of-concept (PoC) is publicly available in the GitHub Security Advisory, providing a step-by-step reproduction sequence that an attacker can follow on a real NocoBase deployment (NocoBase Security Advisory). There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.041% (0.026% per GitHub Advisory), placing it in a low exploitation probability tier. Exploitation requires high privileges (admin-level access to create or trigger workflows), which limits the attacker pool (GitHub Advisory).

1. Reconnaissance: Identify a NocoBase instance running version ≤ 2.0.29 with the plugin-workflow-sql plugin enabled. Confirm admin or high-privileged access to the platform.
2. Create a vulnerable workflow: As an admin, create a collection-trigger workflow on the users table set to trigger after record creation.
3. Add a SQL node with a template variable: Insert a SQL node with a query referencing a user-controlled field, e.g., SELECT id, nickname, email FROM users WHERE nickname = '{{$context.data.nickname}}'.
4. Enable the workflow: Activate the workflow so it executes on the next matching trigger event.
5. Inject malicious payload: Create a new user account (or trigger the workflow via any available mechanism) with the nickname field set to a SQL injection payload, e.g., ' UNION SELECT 1,version(),current_user --.
6. Retrieve results: Check the workflow execution result. The injected UNION SELECT returns database version and current database user information, confirming arbitrary SQL execution. Further payloads can be used to dump tables, extract credentials, or modify records (NocoBase Security Advisory).

• Logs: Workflow execution logs in NocoBase showing SQL node results containing unexpected data such as database version strings (e.g., PostgreSQL 16.x) or database usernames in fields like nickname or email; anomalous SQL execution records in the database query log with UNION SELECT, -- comment sequences, or stacked queries.
• Database: Unexpected queries in the database audit log originating from the NocoBase application user containing UNION SELECT, DROP TABLE, INSERT INTO, or UPDATE statements not matching any configured workflow SQL templates.
• Application: Newly created user accounts with unusual or malformed nickname values containing SQL metacharacters (e.g., single quotes, --, UNION, SELECT).
• Network: Unusual data volumes returned from workflow API endpoints, potentially indicating bulk data exfiltration via repeated workflow triggers (NocoBase Security Advisory).

Upgrade @nocobase/plugin-workflow-sql to version 2.0.30 or later, which replaces direct string substitution with Sequelize parameterized bind parameters (getParsedValueAsParams()) (NocoBase v2.0.30 Release, Fix Commit). As interim mitigations: restrict workflow creation and SQL node configuration to trusted administrators only; audit all existing SQL workflow nodes for template variables sourced from user-controlled fields; and apply database-level access controls to limit the NocoBase database user's privileges (avoid superuser grants). The v2.0.30 UI also introduces a "Migrate to safe mode" option for legacy SQL nodes using the old injection-based approach (GitHub Advisory).

The vulnerability was reported by security researcher CE2Sec and published by NocoBase maintainer mytharcher on April 1, 2026. The fix was included in the v2.0.30 release alongside a UI migration tool to help administrators convert legacy unsafe SQL nodes to the new parameterized mode. No significant broader media coverage or notable external researcher commentary has been identified beyond the official advisory (GitHub Advisory, NocoBase v2.0.30 Release).