2vulnerabilities
- Critical0 (0.0%)
- High1 (50.0%)
- Medium0 (0.0%)
- Moderate1 (50.0%)
- Low0 (0.0%)
nocobase-plugin-collection-sql
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 1HighAffects 1 version
- 0MediumAffects 0 versions
- 1ModerateAffects 3 versions
- 0LowAffects 0 versions
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0
- 1 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (2)
Known vulnerabilities affecting nocobase-plugin-collection-sql, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-v8vm-cqh8-q87q | Moderate | NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass# Security Vulnerability Report: Sensitive Data Exposure via SQL Blacklist Bypass ## Summary The `checkSQL()` function in `plugin-collection-sql` implements a **keyword-based blacklist** to prevent dangerous SQL queries from being executed through the SQL Collection feature. However, the blacklist is **incomplete**: it only checks for a subset of dangerous PostgreSQL system functions and **does not restrict access to sensitive system catalog tables** such as `pg_shadow`, `pg_roles`, or `pg_stat_activity`. An authenticated user with the `admin` role can exploit this to **dump PostgreSQL pass |
| GitHub (opens in a new tab) | |
| GHSA-wrwh-c28m-9jjh | High | @nocobase/plugin-collection-sql: SQL Validation Bypass Through Missing `checkSQL` Call## Summary The `checkSQL()` validation function that blocks dangerous SQL keywords (e.g., `pg_read_file`, `LOAD_FILE`, `dblink`) is applied on the `collections:create` and `sqlCollection:execute` endpoints but is entirely missing on the `sqlCollection:update` endpoint. An attacker with collection management permissions can create a SQL collection with benign SQL, then update it with arbitrary SQL that bypasses all validation, and query the collection to execute the injected SQL and exfiltrate data. **Affected component:** `@nocobase/plugin-collection-sql` **Affected versions:** <= 2.0.32 (co |
| GitHub (opens in a new tab) |
- GHSA-v8vm-cqh8-q87qModerateNocoBase: Sensitive Data Exposure via SQL Blacklist Bypass
< 2.0.62>= 2.1.0-alpha.1, < 2.1.0-alpha.46- +1 more
Affected versions:< 2.0.62>= 2.1.0-alpha.1, < 2.1.0-alpha.46>= 2.1.0-beta.1, < 2.1.0-beta.45
# Security Vulnerability Report: Sensitive Data Exposure via SQL Blacklist Bypass ## Summary The `checkSQL()` function in `plugin-collection-sql` implements a **keyword-based blacklist** to prevent dangerous SQL queries from being executed through the SQL Collection feature. However, the blacklist is **incomplete**: it only checks for a subset of dangerous PostgreSQL system functions and **does not restrict access to sensitive system catalog tables** such as `pg_shadow`, `pg_roles`, or `pg_stat_activity`. An authenticated user with the `admin` role can exploit this to **dump PostgreSQL pass
CVE: CVE-2026-52888
- GHSA-wrwh-c28m-9jjhHigh@nocobase/plugin-collection-sql: SQL Validation Bypass Through Missing `checkSQL` Call
< 2.0.39
## Summary The `checkSQL()` validation function that blocks dangerous SQL keywords (e.g., `pg_read_file`, `LOAD_FILE`, `dblink`) is applied on the `collections:create` and `sqlCollection:execute` endpoints but is entirely missing on the `sqlCollection:update` endpoint. An attacker with collection management permissions can create a SQL collection with benign SQL, then update it with arbitrary SQL that bypasses all validation, and query the collection to execute the injected SQL and exfiltrate data. **Affected component:** `@nocobase/plugin-collection-sql` **Affected versions:** <= 2.0.32 (co
CVE: CVE-2026-41641