Read the docs
TI-2026-27069 Aliases CVE-2026-34825GHSA-vx58-fwwq-5g8j

NocoBase Has SQL Injection via template variable substitution in workflow SQL node

Priority HIGH 78CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.30, NocoBase plugin-workflow-sql substitutes template variables directly into raw SQL strings via getParsedValue() without parameterization or escaping. Any user who triggers a workflow containing a SQL node with template variables from user-controlled data can inject arbitrary SQL. This issue has been patched in version 2.0.30.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00413 35th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed nocobase (nocobase): 2.0.30@nocobase/plugin-workflow-sql (npm): 2.0.30

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nocobasenocobasebefore 2.0.302.0.30Patch availableCNA
—@nocobase/plugin-workflow-sql (npm)before 2.0.302.0.30Patch availableGHSA-vx58-fwwq-5g8j
  • nocobase Vendornocobase Affected before 2.0.30 Fixed in 2.0.30 Patch available CNA
  • @nocobase/plugin-workflow-sql (npm) Vendor— Affected before 2.0.30 Fixed in 2.0.30 Patch available GHSA-vx58-fwwq-5g8j

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nocobase:nocobase:*:*:*:*:*:*:*:*before 2.0.30Vulnerablenocobase
  • cpe:2.3:a:nocobase:nocobase:*:*:*:*:*:*:*:* Versions before 2.0.30 Vulnerable ·nocobase

Remediation

  • Fix · CNA nocobase (nocobase) Fixed in 2.0.30
  • Fix · GHSA-vx58-fwwq-5g8j @nocobase/plugin-workflow-sql (npm) Fixed in 2.0.30 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-34825
  2. 2026-10-03 Alias added: GHSA-vx58-fwwq-5g8j

References

Exploit 1

Patch 1

Advisory 1

Other 2

  • TI-2026-26457 NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node CVSS 3.1CRITICAL 10.0
  • TI-2026-30159 NocoBase Vulnerable to SQL Injection via String Concatenation in Recursive Eager Loading CVSS 3.1HIGH 8.8
  • TI-2026-30160 NocoBase Vulnerable to SQL Validation Bypass via `sqlCollection:update` Missing `checkSQL` Call CVSS 3.1HIGH 7.2
  • TI-2026-29121 NocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins CVSS 4.0MEDIUM 6.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences