CVE-2026-41641

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-41641
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41641.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-41641
Aliases
Published
2026-05-07T04:13:33.609Z
Modified
2026-07-08T08:13:13.109955657Z
Severity
  • 7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
NocoBase Vulnerable to SQL Validation Bypass via `sqlCollection:update` Missing `checkSQL` Call
Details

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.39, the checkSQL() validation function that blocks dangerous SQL keywords (e.g., pgreadfile, LOAD_FILE, dblink) is applied on the collections:create and sqlCollection:execute endpoints but is entirely missing on the sqlCollection:update endpoint. An attacker with collection management permissions can create a SQL collection with benign SQL, then update it with arbitrary SQL that bypasses all validation, and query the collection to execute the injected SQL and exfiltrate data. This issue has been patched in version 2.0.39.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41641.json",
    "cwe_ids": [
        "CWE-284",
        "CWE-89"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/nocobase/nocobase

Affected ranges

Type
GIT
Repo
https://github.com/nocobase/nocobase
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b03cab07e7bc11cf5c79f6b12f28bfcd3ae22aea
Fixed
851aee543efa894142e0f7be03eb55d9cec06a91
Database specific 
{
    "cpe": "cpe:2.3:a:nocobase:nocobase:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.0.39"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.10.0-alpha.2
v0.10.0-alpha.3
v0.10.0-alpha.4
v0.10.0-alpha.5
v0.10.1-alpha.1
v0.11.0-alpha.1
v0.11.1-alpha.1
v0.11.1-alpha.2
v0.11.1-alpha.3
v0.11.1-alpha.4
v0.11.1-alpha.5
v0.12.0-alpha.1
v0.12.0-alpha.2
v0.12.0-alpha.3
v0.12.0-alpha.4
v0.12.0-alpha.5
v0.13.0-alpha.1
v0.13.0-alpha.10
v0.13.0-alpha.2
v0.13.0-alpha.3
v0.13.0-alpha.4
v0.13.0-alpha.5
v0.13.0-alpha.6
v0.13.0-alpha.7
v0.13.0-alpha.8
v0.13.0-alpha.9
v0.14.0-alpha.1
v0.14.0-alpha.2
v0.14.0-alpha.3
v0.14.0-alpha.4
v0.14.0-alpha.6
v0.14.0-alpha.7
v0.14.0-alpha.8
v0.15.0-alpha.1
v0.15.0-alpha.2
v0.15.0-alpha.3
v0.15.0-alpha.4
v0.16.0-alpha.1
v0.16.0-alpha.3
v0.16.0-alpha.4
v0.16.0-alpha.5
v0.16.0-alpha.6
v0.17.0-alpha.1
v0.17.0-alpha.2
v0.17.0-alpha.3
v0.17.0-alpha.4
v0.17.0-alpha.5
v0.17.0-alpha.6
v0.17.0-alpha.7
v0.18.0-alpha.1
v0.18.0-alpha.2
v0.18.0-alpha.3
v0.18.0-alpha.8
v0.18.0-alpha.9
v0.19.0-alpha.1
v0.19.0-alpha.2
v0.19.0-alpha.3
v0.19.0-alpha.4
v0.19.0-alpha.5
v0.19.0-alpha.6
v0.19.0-alpha.7
v0.19.0-alpha.8
v0.19.0-alpha.9
v0.20.0-alpha.1
v0.20.0-alpha.10
v0.20.0-alpha.11
v0.20.0-alpha.12
v0.20.0-alpha.13
v0.20.0-alpha.14
v0.20.0-alpha.15
v0.20.0-alpha.16
v0.20.0-alpha.17
v0.20.0-alpha.2
v0.20.0-alpha.3
v0.20.0-alpha.4
v0.20.0-alpha.5
v0.20.0-alpha.6
v0.20.0-alpha.7
v0.20.0-alpha.8
v0.20.0-alpha.9
v0.21.0-alpha.1
v0.21.0-alpha.10
v0.21.0-alpha.11
v0.21.0-alpha.12
v0.21.0-alpha.13
v0.21.0-alpha.14
v0.21.0-alpha.15
v0.21.0-alpha.16
v0.21.0-alpha.2
v0.21.0-alpha.3
v0.21.0-alpha.4
v0.21.0-alpha.5
v0.21.0-alpha.6
v0.21.0-alpha.7
v0.21.0-alpha.8
v0.21.0-alpha.9
v0.4.0-alpha.1
v0.4.0-alpha.2
v0.4.0-alpha.5
v0.4.0-alpha.6
v0.5.0-alpha.33
v0.7.0-alpha.0
v0.7.0-alpha.1
v0.7.0-alpha.16
v0.7.0-alpha.2
v0.7.0-alpha.24
v0.7.0-alpha.28
v0.7.0-alpha.29
v0.7.0-alpha.3
v0.7.0-alpha.30
v0.7.0-alpha.33
v0.7.0-alpha.34
v0.7.0-alpha.4
v0.7.0-alpha.5
v0.7.0-alpha.57
v0.7.0-alpha.58
v0.7.0-alpha.59
v0.7.0-alpha.6
v0.7.0-alpha.60
v0.7.0-alpha.64
v0.7.0-alpha.67
v0.7.0-alpha.82
v0.7.1-alpha.4
v0.7.1-alpha.5
v0.7.2-alpha.1
v0.7.3-alpha.1
v0.7.4-alpha.1
v0.7.4-alpha.4
v0.7.4-alpha.7
v0.8.0-alpha.1
v0.8.0-alpha.5
v0.8.0-alpha.9
v0.8.1-alpha.2
v0.8.1-alpha.4
v0.9.0-alpha.1
v0.9.0-alpha.2
v0.9.1-alpha.1
v0.9.1-alpha.2
v0.9.2-alpha.2
v0.9.2-alpha.3
v0.9.2-alpha.4
v0.9.3-alpha.1
v0.9.4-alpha.1
v0.9.4-alpha.2
v1.*
v1.0.0-alpha.1
v1.0.0-alpha.10
v1.0.0-alpha.11
v1.0.0-alpha.12
v1.0.0-alpha.13
v1.0.0-alpha.14
v1.0.0-alpha.15
v1.0.0-alpha.16
v1.0.0-alpha.17
v1.0.0-alpha.2
v1.0.0-alpha.3
v1.0.0-alpha.4
v1.0.0-alpha.5
v1.0.0-alpha.6
v1.0.0-alpha.7
v1.0.0-alpha.8
v1.0.0-alpha.9
v1.0.1-alpha.1
v1.0.1-alpha.2
v1.0.1-alpha.3
v1.2.0-alpha
v1.2.1-alpha
v1.2.10-alpha
v1.2.11-alpha
v1.2.2-alpha
v1.2.3-alpha
v1.2.4-alpha
v1.2.5-alpha
v1.2.6-alpha
v1.2.7-alpha
v1.2.8-alpha
v1.2.9-alpha
v1.5.0-alpha.1
v1.5.0-alpha.2
v1.5.0-alpha.3
v1.5.0-alpha.4
v1.5.0-alpha.5
v1.6.0-alpha.1
v1.6.0-alpha.10
v1.6.0-alpha.11
v1.6.0-alpha.12
v1.6.0-alpha.13
v1.6.0-alpha.14
v1.6.0-alpha.15
v1.6.0-alpha.16
v1.6.0-alpha.17
v1.6.0-alpha.18
v1.6.0-alpha.19
v1.6.0-alpha.2
v1.6.0-alpha.20
v1.6.0-alpha.21
v1.6.0-alpha.22
v1.6.0-alpha.23
v1.6.0-alpha.3
v1.6.0-alpha.4
v1.6.0-alpha.5
v1.6.0-alpha.6
v1.6.0-alpha.7
v1.6.0-alpha.8
v1.6.0-alpha.9
v1.6.0-beta.10
v1.6.0-beta.11
v1.6.0-beta.12
v1.6.0-beta.13
v1.6.0-beta.14
v1.6.0-beta.15
v1.6.0-beta.16
v1.6.0-beta.17
v1.6.0-beta.18
v1.6.0-beta.19
v1.6.0-beta.4
v1.6.0-beta.5
v1.6.0-beta.6
v1.6.0-beta.7
v1.6.0-beta.8
v1.6.0-beta.9
v1.7.0-alpha.10
v1.7.0-alpha.11
v1.7.0-alpha.12
v1.7.0-alpha.13
v1.7.0-alpha.14
v1.7.0-alpha.15
v1.7.0-beta.1
v1.7.0-beta.2
v1.7.0-beta.3
v1.7.0-beta.4
v1.7.0-beta.5
v1.7.0-beta.6
v1.7.0-beta.7
v1.7.0-beta.8
v1.7.0-beta.9
v1.8.0-alpha.1
v1.8.0-alpha.10
v1.8.0-alpha.11
v1.8.0-alpha.12
v1.8.0-alpha.13
v1.8.0-alpha.14
v1.8.0-alpha.2
v1.8.0-alpha.3
v1.8.0-alpha.4
v1.8.0-alpha.5
v1.8.0-alpha.6
v1.8.0-alpha.7
v1.8.0-alpha.8
v1.8.0-alpha.9
v1.8.0-beta.13
v1.9.0-alpha.1
v1.9.0-alpha.10
v1.9.0-alpha.11
v1.9.0-alpha.12
v1.9.0-alpha.13
v1.9.0-alpha.14
v1.9.0-alpha.15
v1.9.0-alpha.16
v1.9.0-alpha.17
v1.9.0-alpha.2
v1.9.0-alpha.3
v1.9.0-alpha.4
v1.9.0-alpha.5
v1.9.0-alpha.6
v1.9.0-alpha.7
v1.9.0-alpha.8
v1.9.0-alpha.9
v2.*
v2.0.0
v2.0.0-alpha.1
v2.0.0-alpha.10
v2.0.0-alpha.11
v2.0.0-alpha.12
v2.0.0-alpha.13
v2.0.0-alpha.14
v2.0.0-alpha.15
v2.0.0-alpha.16
v2.0.0-alpha.17
v2.0.0-alpha.18
v2.0.0-alpha.19
v2.0.0-alpha.2
v2.0.0-alpha.20
v2.0.0-alpha.21
v2.0.0-alpha.22
v2.0.0-alpha.23
v2.0.0-alpha.24
v2.0.0-alpha.25
v2.0.0-alpha.26
v2.0.0-alpha.27
v2.0.0-alpha.28
v2.0.0-alpha.29
v2.0.0-alpha.3
v2.0.0-alpha.30
v2.0.0-alpha.31
v2.0.0-alpha.32
v2.0.0-alpha.33
v2.0.0-alpha.34
v2.0.0-alpha.35
v2.0.0-alpha.36
v2.0.0-alpha.37
v2.0.0-alpha.38
v2.0.0-alpha.39
v2.0.0-alpha.4
v2.0.0-alpha.40
v2.0.0-alpha.41
v2.0.0-alpha.42
v2.0.0-alpha.43
v2.0.0-alpha.44
v2.0.0-alpha.45
v2.0.0-alpha.46
v2.0.0-alpha.47
v2.0.0-alpha.48
v2.0.0-alpha.49
v2.0.0-alpha.5
v2.0.0-alpha.50
v2.0.0-alpha.51
v2.0.0-alpha.52
v2.0.0-alpha.53
v2.0.0-alpha.54
v2.0.0-alpha.55
v2.0.0-alpha.56
v2.0.0-alpha.57
v2.0.0-alpha.58
v2.0.0-alpha.59
v2.0.0-alpha.6
v2.0.0-alpha.60
v2.0.0-alpha.61
v2.0.0-alpha.62
v2.0.0-alpha.63
v2.0.0-alpha.64
v2.0.0-alpha.65
v2.0.0-alpha.66
v2.0.0-alpha.67
v2.0.0-alpha.68
v2.0.0-alpha.69
v2.0.0-alpha.7
v2.0.0-alpha.70
v2.0.0-alpha.71
v2.0.0-alpha.8
v2.0.0-alpha.9
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.0.16
v2.0.17
v2.0.18
v2.0.19
v2.0.2
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.24
v2.0.25
v2.0.26
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.30
v2.0.31
v2.0.32
v2.0.33
v2.0.34
v2.0.35
v2.0.36
v2.0.37
v2.0.38
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41641.json"