CVE-2026-112306: NocoBase plugin-collection-sql through 2.2.28 SQL Injection via sqlCollection:setFields
NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL() through the sqlCollection:setFields action. Attackers holding the collection-sql snippet can replace a benign collection query with dangerous statements executed on reload, reading pgshadow password hashes or calling pgreadfile.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must be a privileged user and hold the collection-sql snippet. The issue is exposed through the sqlCollection:setFields action.
What must an attacker do for the injected SQL to run?
The attacker can replace a benign collection query with unvalidated SQL by bypassing checkSQL(). The stored statements are executed when the collection is reloaded.
What is the potential impact of a successful exploit?
Injected statements can read pg_shadow password hashes or invoke pg_read_file. The reported impact includes compromise of confidentiality, integrity, and availability.