NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.30, NocoBase plugin-workflow-sql substitutes template variables directly into raw SQL strings via getParsedValue() without parameterization or escaping. Any user who triggers a workflow containing a SQL node with template variables from user-controlled data can inject arbitrary SQL. This issue has been patched in version 2.0.30.

Affected: npm: @nocobase/plugin-workflow-sql

## Summary

NocoBase <= 2.0.8 `plugin-workflow-sql` substitutes template variables directly into raw SQL strings via `getParsedValue()` without parameterization or escaping. Any user who triggers a workflow containing a SQL node with template variables from user-controlled data can inject arbitrary SQL.

## Affected Versions

- Affected: all versions through 2.0.8

## Details

The `SQLInstruction` in `packages/plugins/@nocobase/plugin-workflow-sql/src/server/SQLInstruction.ts` line 28 processes SQL templates:

```typescript // SQLInstruction.ts:28 const sql = processor.getParsedValue(node.config.sql || '', node.id).trim(); ```

Then executes the resulting string directly:

```typescript // SQLInstruction.ts:35 const [result] = await collectionManager.db.sequelize.query(sql, { transaction: this.workflow.useDataSourceTransaction(dataSourceName, processor.transaction), }); ```

`getParsedValue()` performs simple string substitution of `{{$context.data.fieldName}}` placeholders with values from the workflow trigger data. No escaping, quoting, or parameterized binding is applied.

When an admin creates a SQL node with a template like: ```sql SELECT * FROM users WHERE nickname = '{{$context.data.nickname}}' ```

Any user who triggers the workflow with a crafted value can break out of the string literal and inject arbitrary SQL.

## Proof of Concept

1. Login as admin 2. Create a collection-trigger workflow on the `users` table (mode: after create) 3. Add a SQL node with: ```sql…