EUVD-2026-308953

fkie_cve-2026-41640

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.39, the queryParentSQL() function in the core database package constructs a recursive CTE query by joining nodeIds with string concatenation instead of using parameterized queries. The nodeIds array contains primary key values read from database rows. An attacker who can create a record with a malicious string primary key can inject arbitrary SQL when any subsequent request triggers recursive eager loading on that collection. This issue has been patched in version 2.0.39.

GHSA-4948-f92q-f432 — @nocobase/database has SQL Injection via String Concatenation through Recursive Eager Loading

Affected: npm: @nocobase/database

## Summary

The `queryParentSQL()` function in the core database package constructs a recursive CTE query by joining `nodeIds` with string concatenation instead of using parameterized queries. The `nodeIds` array contains primary key values read from database rows. An attacker who can create a record with a malicious string primary key can inject arbitrary SQL when any subsequent request triggers recursive eager loading on that collection.

**Affected component:** `@nocobase/database` (core) **Affected versions:** <= 2.0.32 (confirmed) **Minimum privilege:** Any user with record-creation permission on a tree collection with string-type primary keys

## Vulnerable Code

`packages/core/database/src/eager-loading/eager-loading-tree.ts:59-84`

```javascript const queryParentSQL = (options: { db: Database; nodeIds: any[]; collection: Collection; foreignKey: string; targetKey: string; }) => { const { collection, db, nodeIds } = options; const tableName = collection.quotedTableName(); const { foreignKey, targetKey } = options; const foreignKeyField = collection.model.rawAttributes[foreignKey].field; const targetKeyField = collection.model.rawAttributes[targetKey].field;

const queryInterface = db.sequelize.getQueryInterface(); const q = queryInterface.quoteIdentifier.bind(queryInterface); return `WITH RECURSIVE cte AS ( SELECT ${q(targetKeyField)}, ${q(foreignKeyField)} FROM ${tableName} WHERE ${q(targetKeyField)} IN ('${nodeIds.join("','…

Most recent entries from all

EUVD-2026-308953

fkie_cve-2026-41640

GHSA-4948-f92q-f432 — @nocobase/database has SQL Injection via String Concatenation through Recursive Eager Loading