Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:npm/%40nocobase/plugin-collection-sql@1.8.0-beta.2
purl pkg:npm/%40nocobase/plugin-collection-sql@1.8.0-beta.2
Next non-vulnerable version 2.0.39
Latest non-vulnerable version 2.0.39
Risk 4.0
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-rpgg-v2fa-eyaw
Aliases:
CVE-2026-41641
GHSA-wrwh-c28m-9jjh
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.39, the checkSQL() validation function that blocks dangerous SQL keywords (e.g., pg_read_file, LOAD_FILE, dblink) is applied on the collections:create and sqlCollection:execute endpoints but is entirely missing on the sqlCollection:update endpoint. An attacker with collection management permissions can create a SQL collection with benign SQL, then update it with arbitrary SQL that bypasses all validation, and query the collection to execute the injected SQL and exfiltrate data. This issue has been patched in version 2.0.39.
2.0.39
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-12T22:12:23.768927+00:00 GitLab Importer Affected by VCID-rpgg-v2fa-eyaw https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/@nocobase/plugin-collection-sql/CVE-2026-41641.yml 38.6.0