CVE-2026-34825 NocoBase Has SQL Injection via template variable substitution in workflow SQL node
Attackers can inject arbitrary SQL via workflow template variables in NocoBase, allowing unauthorized data access or modification.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-34825?
CVE-2026-34825 is a high-severity SQL injection vulnerability in nocobase, published on 2 Apr 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.30, NocoBase plugin-workflow-sql substitutes template variables directly into raw SQL strings via getParsedValue() without parameterization or escaping. Any user who triggers a workflow containing a SQL node with template variables from user-controlled data can inject arbitrary SQL. This issue has been patched in version 2.0.30.
Weakness: CWE-89
Which versions are affected by CVE-2026-34825?
2 open source packages ship an affected version, including @nocobase/plugin-workflow-sql. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@nocobase/plugin-workflow-sql npm | All versions | 2.0.30 |
@nocobase/plugin-workflow-sql npm | All versions | 2.0.30 |
Products include Nocobase Nocobase.
How do I fix CVE-2026-34825?
Upgrade @nocobase/plugin-workflow-sql to 2.0.30 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-34825 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-34825 exists.
Other vulnerabilities in nocobase
- CVE-2026-34156 NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node
- CVE-2026-41640 NocoBase Vulnerable to SQL Injection via String Concatenation in Recursive Eager Loading
- CVE-2026-41641 NocoBase Vulnerable to SQL Validation Bypass via `sqlCollection:update` Missing `checkSQL` Call
- CVE-2026-40346 NocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins
Sources
Also known as GHSA-vx58-fwwq-5g8j.