NocoBase SQL Injection Allows Privileged Users to Bypass Validation
A flaw in NocoBase through 2.2.28 lets attackers store unvalidated SQL via the collection plugin, risking database exfiltration.
Key points
- CVE-2026-112306 carries a CVSS score of 8.6, rated high severity.
- The vulnerability exists in the @nocobase/plugin-collection-sql component.
- Attackers can bypass the checkSQL() function to execute stored malicious queries.
NocoBase versions up to 2.2.28 contain a stored SQL injection flaw in the collection-sql plugin that enables privileged users to inject arbitrary database commands. This vulnerability, tracked as CVE-2026-112306, allows attackers to circumvent built-in validation mechanisms and execute persistent SQL statements upon data reload.
Root cause
The issue stems from the sqlCollection:setFields action within the plugin. According to the NVD record, this action fails to properly sanitise input when handling SQL snippets. Consequently, malicious actors can store unvalidated SQL code by bypassing the intended checkSQL() function. This stored payload remains dormant until the application reloads the collection data.
Attack path
An attacker must first obtain access with the collection-sql snippet permission. Once inside, they can replace a benign collection query with dangerous statements. The source material notes that these statements execute on reload. Potential abuses include reading pg_shadow password hashes or calling pg_read_file to access sensitive system data.
Affected versions
- NocoBase versions up to and including 2.2.28 are affected.
- The specific component is @nocobase/plugin-collection-sql.
- No newer version is mentioned in the source as containing a fix.
Mitigation
- No patch or update has been confirmed in the provided material.
- Restrict access to the collection-sql snippet permission strictly to essential administrators.
- Monitor for unusual database queries originating from the plugin.
Signals worth monitoring
Teams usually detect stored injection attempts by reviewing application logs for unexpected sqlCollection:setFields actions. Security operations centres should check whether any queries bypass standard validation patterns. Database audit trails are critical; look for reads of system tables like pg_shadow or file access commands such as pg_read_file. Containment often involves isolating affected database instances and revoking the specific plugin permissions used to inject the payload.
What to do and how to stay safe: NocoBase
- Audit all user accounts with access to the collection-sql plugin.
- Monitor database logs for execution of system-level functions.
- Restrict the sqlCollection:setFields action to trusted administrative interfaces.
- Plan to upgrade once the vendor provides a verified update.
Step-by-step guide: Out-of-band patches: what small businesses need to know
General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which CVE ID covers this NocoBase vulnerability?
The vulnerability is tracked as CVE-2026-112306.
What is the severity rating for this flaw?
The CVSS score is 8.6, which is rated as high severity.
Is there a fix available for NocoBase 2.2.28?
The source material does not confirm that a patch or fix has been released.
