CVE-2026-112306 in NocoBase
Summary
by MITRE • 10/19/2026
NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL() through the sqlCollection:setFields action. Attackers holding the collection-sql snippet can replace a benign collection query with dangerous statements executed on reload, reading pg_shadow password hashes or calling pg_read_file.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in NocoBase versions up to 2.2.28 represents a critical SQL injection flaw within the plugin-collection-sql module, specifically affecting the sqlCollection:setFields action. This security defect arises from an insufficient validation mechanism where the checkSQL function fails to adequately sanitize or validate user-supplied input before it is persisted in the database configuration. Consequently, authenticated users with specific privileges can inject arbitrary and unvalidated SQL statements into the system's collection definitions. The core technical failure lies in the bypass of existing safeguards, allowing malicious actors to store dangerous query structures that are not immediately executed but are instead saved for later processing during data reload operations.
From an operational perspective, this vulnerability poses a severe risk because it enables privilege escalation and unauthorized data access through deferred execution. An attacker who possesses the necessary permissions to modify collection fields can embed harmful SQL code within these definitions. When the system subsequently reloads or processes these collections, the embedded malicious statements are executed with the privileges of the application's database user account. This mechanism effectively transforms a configuration-level vulnerability into an active exploitation vector for data exfiltration and potential remote command execution via database-specific features such as file reading functions.
The impact of this flaw is significant, particularly in environments relying on PostgreSQL databases where specific built-in functions can be abused. By injecting statements that target system tables like pg_shadow, attackers can retrieve password hashes for all users within the database, facilitating offline cracking attacks to gain further access. Furthermore, the ability to invoke functions such as pg_read_file allows an attacker to read arbitrary files from the server's file system where the database resides. This capability extends beyond simple data theft, potentially leading to full system compromise if sensitive configuration files or application source code are accessible through this vector.
This vulnerability aligns with CWE-89 Improper Neutralization of Special Elements used in an SQL Command and is categorized under ATT&CK technique T1059 Command and Scripting Interpreter via database commands. To mitigate this risk, organizations should immediately upgrade to a patched version of NocoBase that addresses the validation logic within the checkSQL function. In addition to upgrading, administrators should enforce strict least-privilege principles for application database accounts, ensuring they do not have access to sensitive system tables or file reading capabilities. Input validation and parameterized queries must be rigorously implemented in all custom plugins and extensions to prevent similar injection flaws from being introduced into the platform's ecosystem.