CVE-2026-41478: 
JavaScript vulnerability analysis and mitigation

CVE-2026-41478 is a critical SQL injection vulnerability in Saltcorn's mobile-sync routes, classified under CWE-89. It allows any authenticated low-privilege user with read access to at least one table to inject arbitrary SQL through sync parameters, potentially leading to full database exfiltration, modification, or destruction. Affected versions include all Saltcorn releases prior to 1.4.6, versions 1.5.0–1.5.5, and 1.6.0 pre-releases prior to 1.6.0-beta.5. The vulnerability was published on April 24, 2026, with the GitHub Security Advisory (GHSA-jp74-mfrx-3qvh) credited to researcher QiaoNPC. It carries a CVSS v3.1 base score of 9.9 (Critical) (GitHub Advisory, Feedly).

The root cause (CWE-89) is the direct interpolation of user-controlled request body values into SQL template literals without parameterization, type enforcement, or sanitization. Specifically, req.body.syncInfos[tableName].maxLoadedId is embedded into SQL queries in getSyncRows() and timestamp-derived values are similarly interpolated in getDelRows() within packages/server/routes/sync.js. Although db.sqlsanitize() is used for SQL identifiers elsewhere in the codebase, it does not protect against value-based injection and is not applied to these interpolated values. The vulnerable endpoints are POST /sync/load_changes and POST /sync/deletes, both accessible to any authenticated user with at least one readable table. No parseInt(), numeric validation, or prepared-statement binding is applied before concatenation into the query string, making the injection directly exploitable (GitHub Advisory).

Successful exploitation allows an authenticated low-privilege user to escalate to database-wide compromise, enabling full exfiltration of all database contents including admin password hashes, configuration secrets, application data, and schema information. Depending on the database backend, the attacker may also perform write operations, schema modifications, or destructive actions such as dropping tables. The scope change (S:C in CVSS) reflects that the impact extends beyond the Saltcorn application itself to the underlying database system, potentially affecting all data stored across the platform (GitHub Advisory, Feedly).

As of the time of reporting, no public proof-of-concept exploit code has been released and no active in-the-wild exploitation has been observed (Feedly). However, the GitHub Security Advisory confirms that the injection is "practically exploitable," with provided evidence demonstrating successful extraction of user records and schema information through the vulnerable sync route. The EPSS score is approximately 0.03%, reflecting low current exploitation probability. No threat actor attribution or CISA KEV catalog listing has been identified at this time (GitHub Advisory).

1. Reconnaissance: Identify a Saltcorn instance exposing mobile-sync routes (e.g., POST /sync/load_changes) and confirm it is running a vulnerable version (prior to 1.4.6, 1.5.0–1.5.5, or 1.6.0 pre-beta.5).
2. Obtain low-privilege credentials: Register or obtain any valid authenticated account that has read access to at least one table within the Saltcorn application.
3. Authenticate: Log in to the Saltcorn instance and obtain a valid session token or cookie.
4. Craft malicious request: Send a crafted HTTP POST request to /sync/load_changes with a JSON body where syncInfos[tableName].maxLoadedId contains a malicious SQL expression instead of a numeric ID (e.g., "maxLoadedId": "0 UNION SELECT username, password, null FROM users--").
5. Inject arbitrary SQL: The server interpolates the attacker-controlled value directly into the SQL query in getSyncRows() without parameterization, causing the injected SQL to execute in the database context.
6. Exfiltrate data: The sync response returns attacker-selected database contents, including admin password hashes, configuration secrets, and any other table data accessible to the database user.
7. Escalate (optional): Depending on the backend (e.g., PostgreSQL with COPY or SQLite), leverage write capabilities to modify data, create backdoor accounts, or perform destructive operations (GitHub Advisory).

• Network: Unusual or repeated POST requests to /sync/load_changes or /sync/deletes endpoints from low-privilege user accounts; requests with abnormally large or syntactically complex maxLoadedId values (e.g., containing SQL keywords like UNION, SELECT, --, or semicolons).
• Logs: Application or web server access logs showing POST requests to sync endpoints with non-numeric values in sync metadata fields; database query logs containing unexpected UNION SELECT statements or schema-querying SQL (e.g., information_schema).
• Database: Unexpected queries against sensitive tables (e.g., users, _sc_config) from the application database user outside of normal application flow; evidence of bulk data reads or schema enumeration queries.
• Application: Sync API responses containing data from tables not normally returned in sync operations, or responses with unusually large payloads (GitHub Advisory).

Saltcorn has released patched versions that address this vulnerability by properly parameterizing SQL queries in the affected sync routes. Users should upgrade to 1.4.6 (for versions prior to 1.5.0), 1.5.6 (for 1.5.x versions), or 1.6.0-beta.5 (for 1.6.0 pre-release users) immediately. As interim mitigations, administrators should restrict network access to Saltcorn instances, limit read access to sensitive tables for low-privilege users, and monitor database logs for suspicious SQL activity. No configuration-only workaround is available that fully mitigates the vulnerability without patching (GitHub Advisory, Feedly).

The vulnerability was reported by researcher QiaoNPC and disclosed via GitHub's security advisory program. A technical write-up was published by The Hacker Wire covering the SQL injection via unparameterized sync endpoints. Community discussion was noted on Bluesky (cyberhub.blog). No major vendor statements beyond the Saltcorn project's own advisory have been identified, and media coverage has been limited to security-focused outlets and vulnerability aggregators (GitHub Advisory, The Hacker Wire).