CVE-2026-112306 — NocoBase plugin-collection-sql through 2.2.28 SQL Injection via sqlCollection:setFields
NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL() thr…
Published: 2026-10-19 · CVSS: 8.6 · CVSS 4.0
NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL() through the sqlCollection:setFields action. Attackers holding the collection-sql snippet can replace a benign collection query with dangerous statements executed on reload, reading pg_shadow password hashes or calling pg_read_file.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7