CVE-2026-34825: NocoBase Has SQL Injection via template variable substitution in workflow SQL node

April 1, 2026 (updated May 11, 2026)

NocoBase <= 2.0.8 plugin-workflow-sql substitutes template variables directly into raw SQL strings via getParsedValue() without parameterization or escaping. Any user who triggers a workflow containing a SQL node with template variables from user-controlled data can inject arbitrary SQL.

References

github.com/advisories/GHSA-vx58-fwwq-5g8j
github.com/nocobase/nocobase/commit/75da3dddc4aba739c398f7072725dcf7f5487f5c
github.com/nocobase/nocobase/releases/tag/v2.0.30
github.com/nocobase/nocobase/security/advisories/GHSA-vx58-fwwq-5g8j
nvd.nist.gov/vuln/detail/CVE-2026-34825

Code Behaviors & Features

Detect and mitigate CVE-2026-34825 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →