Threats affecting pkg:github/nocobase

NocoBase plugin-collection-sql versions up to 2.2.28 contain an SQL injection vulnerability that allows privileged users to bypass input validation and store malicious SQL commands. This flaw enables attackers with access to the collection-sql snippet to replace safe queries with harmful statements that execute on reload, potentially exposing sensitive data such as PostgreSQL password hashes or reading files on the server.

CVE-2026-88402 is a critical SQL injection vulnerability in the checkSQL function of nocobase version 2.1.21. This flaw allows attackers to inject crafted SQL statements, potentially exposing sensitive database information and impacting confidentiality, integrity, and availability.

CVE-2026-88403 is a Server-Side Request Forgery (SSRF) vulnerability in the serverRequest function of nocobase version prior to 2.1.21. It allows authenticated attackers to scan internal resources by sending crafted HTTP requests. The vulnerability has a medium severity with a CVSS score of 6.5. No official patch or fix information is provided in the available data.