CVE-2026-41641
SQL Validation Bypass Through Missing checkSQL Call
01Record
| Identifier | CVE-2026-41641 |
|---|---|
| Project | NocoBase |
| Component | @nocobase/plugin-collection-sql |
| CWE | CWE-89 |
| CVSS | 7.2 |
| Disclosed | 2026-04-22 |
| Endor reference | ENDOR-VUL-2026-16042 |
| Writeup | Link |
02Detail
Description: NocoBase guards SQL collections with a checkSQL validator, but the sqlCollection:update action never calls it. The create path validates and the update path does not, so a user who can reach update supplies SQL that the validator would have rejected and it executes unchecked. Affects @nocobase/plugin-collection-sql before 2.0.39.
Impact: SQL Injection. Also tracked as CWE-284, because the defect is an authorization control that exists on one route and is absent on its sibling.
Fixed in 2.0.39 (PR #9134, 851aee54). One of three companion findings to the SES compartment escape in ENDOR-VUL-2026-16041, all repeating the same pattern of a real control that does not cover every path reaching its sink. Full analysis is in the technical whitepaper.
Discovered by Peyton Kennedy (p80n).