A SQL Injection vulnerability exists in the @nocobase/database package (versions prior to 2.0.39) due to unsafe string concatenation in recursive eager loading queries. An attacker with permission to create records in a tree collection with string-type primary keys can inject arbitrary SQL by crafting malicious primary key values. This flaw allows injection in the recursive Common Table Expression (CTE) query construction, potentially exposing sensitive data or causing runtime errors.