Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-rpgg-v2fa-eyaw
Vulnerability ID VCID-rpgg-v2fa-eyaw
Aliases CVE-2026-41641
GHSA-wrwh-c28m-9jjh
Summary NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.39, the checkSQL() validation function that blocks dangerous SQL keywords (e.g., pg_read_file, LOAD_FILE, dblink) is applied on the collections:create and sqlCollection:execute endpoints but is entirely missing on the sqlCollection:update endpoint. An attacker with collection management permissions can create a SQL collection with benign SQL, then update it with arbitrary SQL that bypasses all validation, and query the collection to execute the injected SQL and exfiltrate data. This issue has been patched in version 2.0.39.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-284 Improper Access Control
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00211 https://api.first.org/data/v1/epss?cve=CVE-2026-41641
epss 0.00211 https://api.first.org/data/v1/epss?cve=CVE-2026-41641
epss 0.00211 https://api.first.org/data/v1/epss?cve=CVE-2026-41641
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-wrwh-c28m-9jjh
cvssv3.1 7.2 https://github.com/nocobase/nocobase
generic_textual HIGH https://github.com/nocobase/nocobase
cvssv3.1 7.2 https://github.com/nocobase/nocobase/commit/851aee543efa894142e0f7be03eb55d9cec06a91
generic_textual HIGH https://github.com/nocobase/nocobase/commit/851aee543efa894142e0f7be03eb55d9cec06a91
ssvc Track* https://github.com/nocobase/nocobase/commit/851aee543efa894142e0f7be03eb55d9cec06a91
cvssv3.1 7.2 https://github.com/nocobase/nocobase/pull/9134
generic_textual HIGH https://github.com/nocobase/nocobase/pull/9134
ssvc Track* https://github.com/nocobase/nocobase/pull/9134
cvssv3.1 7.2 https://github.com/nocobase/nocobase/releases/tag/v2.0.39
generic_textual HIGH https://github.com/nocobase/nocobase/releases/tag/v2.0.39
ssvc Track* https://github.com/nocobase/nocobase/releases/tag/v2.0.39
cvssv3.1 7.2 https://github.com/nocobase/nocobase/security/advisories/GHSA-wrwh-c28m-9jjh
cvssv3.1_qr HIGH https://github.com/nocobase/nocobase/security/advisories/GHSA-wrwh-c28m-9jjh
generic_textual HIGH https://github.com/nocobase/nocobase/security/advisories/GHSA-wrwh-c28m-9jjh
ssvc Track* https://github.com/nocobase/nocobase/security/advisories/GHSA-wrwh-c28m-9jjh
cvssv3.1 7.2 https://nvd.nist.gov/vuln/detail/CVE-2026-41641
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2026-41641
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-41641
https://github.com/nocobase/nocobase
https://nvd.nist.gov/vuln/detail/CVE-2026-41641
851aee543efa894142e0f7be03eb55d9cec06a91 https://github.com/nocobase/nocobase/commit/851aee543efa894142e0f7be03eb55d9cec06a91
9134 https://github.com/nocobase/nocobase/pull/9134
GHSA-wrwh-c28m-9jjh https://github.com/advisories/GHSA-wrwh-c28m-9jjh
GHSA-wrwh-c28m-9jjh https://github.com/nocobase/nocobase/security/advisories/GHSA-wrwh-c28m-9jjh
v2.0.39 https://github.com/nocobase/nocobase/releases/tag/v2.0.39
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/nocobase/nocobase
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/nocobase/nocobase/commit/851aee543efa894142e0f7be03eb55d9cec06a91
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2026-05-07T14:13:49Z/ Found at https://github.com/nocobase/nocobase/commit/851aee543efa894142e0f7be03eb55d9cec06a91
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/nocobase/nocobase/pull/9134
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2026-05-07T14:13:49Z/ Found at https://github.com/nocobase/nocobase/pull/9134
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/nocobase/nocobase/releases/tag/v2.0.39
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2026-05-07T14:13:49Z/ Found at https://github.com/nocobase/nocobase/releases/tag/v2.0.39
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/nocobase/nocobase/security/advisories/GHSA-wrwh-c28m-9jjh
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2026-05-07T14:13:49Z/ Found at https://github.com/nocobase/nocobase/security/advisories/GHSA-wrwh-c28m-9jjh
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2026-41641
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.43742
EPSS Score 0.00211
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:51:18.589766+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/41xxx/CVE-2026-41641.json 38.6.0