CVE-2026-41640
SQL Injection via String Concatenation in Recursive Eager Loading
01Record
| Identifier | CVE-2026-41640 |
|---|---|
| Project | NocoBase |
| Component | @nocobase/database |
| CWE | CWE-89 |
| CVSS | 7.5 |
| Disclosed | 2026-04-22 |
| Endor reference | ENDOR-VUL-2026-16043 |
| Writeup | Link |
02Detail
Description: queryParentSQL() in @nocobase/database builds a recursive CTE by string concatenation rather than parameter binding, so values reaching eager-loading-tree.ts:59 are SQL source. The sink is reachable from a record-create on a tree collection. Affects @nocobase/database before 2.0.39.
Impact: SQL Injection.
Fixed in 2.0.39 (PR #9133, 202e2b8e). NVD's own analysis scores this 8.8; the 7.5 recorded here is the score published with the advisory. One of three companion findings to the SES compartment escape in ENDOR-VUL-2026-16041. Full analysis is in the technical whitepaper.
Discovered by Peyton Kennedy (p80n).