High, CVSS 7.5npmAmendedPublished
@nocobase/database has SQL Injection via String Concatenation through Recursive Eager Loading
CVE-2026-41640 · GHSA-4948-f92q-f432
- Affected
- npm @nocobase/database < 2.0.39
- Fixed in
- 2.0.39· Vendor fix available
- Issue
- The queryParentSQL() function in the core database package constructs a recursive CTE query by joining nodeIds with string concatenation instead of using parameterized queries. The nodeIds array contains primary key values read from database rows. An attacker who can create a record with a malicious string primary key can inject arbitrary SQL when any subsequent request triggers recursive eager loading on that collection. Affected component: @nocobase/database (core) Affected versions: <= 2.0.32 (confirmed) Minimum privilege: Any user with record-creation permission on a tree collection with string-type primary keys Vulnerable Code packages/core/database/src/eager-loading/eager-loading-tree.ts:59-84 This function is called at line 384 when a BelongsTo association has recursively: true and instances exist: PoC The payload keeps the CTE syntactically valid by injecting a third UNION ALL branch. The closing ') from the original template literal completes the injected WHERE…
Recommended action: Upgrade to 2.0.39 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.