Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.39, the checkSQL() validation function that blocks dangerous SQL keywords (e.g., pg_read_file, LOAD_FILE, dblink) is applied on the collections:create and sqlCollection:execute endpoints but is entirely missing on the sqlCollection:update endpoint. An attacker with collection management permissions can create a SQL collection with benign SQL, then update it with arbitrary SQL that bypasses all validation, and query the collection to execute the injected SQL and exfiltrate data. This issue has been patched in version 2.0.39.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-41641 NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.39, the checkSQL() validation fu… https://www.cve.org/CVERecord?id=CVE-2026-41641
Post summary
The post announces CVE-2026-41641 and notes it affects versions prior to 2.0.39, but it contains no PoC, exploit code, active exploitation evidence, or patch information.
🚨 CVE-2026-41641 - high 🚨 NocoBase - SQL Injection > NocoBase @nocobase/plugin-collection-sql versions prior to 2.0.39 are vulnerable to S... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-41641 @pdnuclei #NucleiTemplates #cve
Post summary
The tweet announces a high‑severity SQL injection vulnerability (CVE‑2026‑41641) in NocoBase plugin-collection-sql versions before 2.0.39, providing a link for further details.
[CVE-2026-41641] NocoBase - SQL Injection 💥 NocoBase nocobase/plugin-collection-sql versions prior to 2.0.39 are vulnerable to SQL injection via the sqlCollection:update endpoint. 🔗 https://cloud.projectdiscovery.io/library/CVE-2026-41641 🔗 https://www.miggo.io/vulnerability-database/cve/CVE-2026-41641 https://t.co/95NQk3x05J
Post summary
The note discloses a SQL injection vulnerability in old NocoBase plugin collections, detailing affected versions and the vulnerable endpoint, but does not provide PoC, exploit code, active exploitation evidence, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | nocobase | nocobase | - | - | - |