CVE-2026-41640 NocoBase Vulnerable to SQL Injection via String Concatenation in Recursive Eager Loading
Attackers can inject arbitrary SQL via malicious primary keys in NocoBase, potentially leading to code execution or data theft.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41640?
CVE-2026-41640 is a high-severity SQL injection vulnerability in nocobase, published on 7 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.39, the queryParentSQL() function in the core database package constructs a recursive CTE query by joining nodeIds with string concatenation instead of using parameterized queries. The nodeIds array contains primary key values read from database rows. An attacker who can create a record with a malicious string primary key can inject arbitrary SQL when any subsequent request triggers recursive eager loading on that collection. This issue has been patched in version 2.0.39.
Weakness: CWE-89
Which versions are affected by CVE-2026-41640?
2 open source packages ship an affected version, including @nocobase/database. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@nocobase/database npm | All versions | 2.0.39 |
@nocobase/database npm | All versions | 2.0.39 |
Products include Nocobase Nocobase.
How do I fix CVE-2026-41640?
Upgrade @nocobase/database to 2.0.39 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-41640 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-41640 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in nocobase
- CVE-2026-34156 NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node
- CVE-2026-34825 NocoBase Has SQL Injection via template variable substitution in workflow SQL node
- CVE-2026-41641 NocoBase Vulnerable to SQL Validation Bypass via `sqlCollection:update` Missing `checkSQL` Call
- CVE-2026-40346 NocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins
Sources
Also known as GHSA-4948-f92q-f432.