nocobase vulnerabilities
CVEs whose affected-version data names the nocobase package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-112306High· 7.2NocoBase plugin-collection-sql through 2.2.28 SQL Injection via sqlCollection:setFields
NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL() through the sqlCollection:setFields action. Attackers holding t…
▾ Twilightnocobase · nocobaseEPSS 0.31%via CVEORG
CVE-2026-34156Critical· 9.9PoCNocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.28, NocoBase's Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with …
▾ Abyssalnocobase · nocobaseEPSS 35%via NVD