Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
2.1.0-alpha.462.0.622.1.0-beta.45· Vendor fix available
Issue
Security Vulnerability Report: Sensitive Data Exposure via SQL Blacklist Bypass Summary The checkSQL() function in plugin-collection-sql implements a keyword-based blacklist to prevent dangerous SQL queries from being executed through the SQL Collection feature. However, the blacklist is incomplete: it only checks for a subset of dangerous PostgreSQL system functions and does not restrict access to sensitive system catalog tables such as pgshadow, pgroles, or pgstatactivity. An authenticated user with the admin role can exploit this to dump PostgreSQL password hashes (pgshadow), read all NocoBase user credentials (hashed passwords from the users table), and enumerate the full database schema — all data that admin users should never be able to access through the application interface. --- Affected Component File: packages/plugins/@nocobase/plugin-collection-sql/src/server/utils.ts The execute action in sql.ts passes user-supplied SQL directly through this insufficient check: --- Root…
Recommended action: Upgrade to 2.1.0-beta.45 (pre-release), 2.1.0-alpha.46 (pre-release) or 2.0.62 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The checkSQL() validation function that blocks dangerous SQL keywords (e.g., pgreadfile, LOADFILE, dblink) is applied on the collections:create and sqlCollection:execute endpoints but is entirely missing on the sqlCollection:update endpoint. An attacker with collection management permissions can create a SQL collection with benign SQL, then update it with arbitrary SQL that bypasses all validation, and query the collection to execute the injected SQL and exfiltrate data. Affected component: @nocobase/plugin-collection-sql Affected versions: <= 2.0.32 (confirmed) Minimum privilege: Collection management permissions (pm.data-source-manager.collection-sql snippet) Vulnerable Code checkSQL is applied on create and execute packages/plugins/@nocobase/plugin-collection-sql/src/server/resources/sql.ts checkSQL is NOT applied on update The checkSQL function itself packages/plugins/@nocobase/plugin-collection-sql/src/server/utils.ts:10-28 PoC Impact - Confidentiality: Arbitrary SELECT…
Recommended action: Upgrade to 2.0.39 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.