nocobase has 5 CVEs on record. 2 were published in the last 90 days. The median CVSS is 8.6 (high), with 2 rated critical. None have a confirmed exploitation report. Most affected products: nocobase (2), @nocobase/plugin-collection-sql (1), @nocobase/plugin-notification-in-app-message (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.6
- Publish → KEV
- —
- Last 90 days
- 2 prev 2
Products
- nocobase 2
- @nocobase/plugin-collection-sql 1
- @nocobase/plugin-notification-in-app-message 1
- @nocobase/server 1
Worst active — by depth score
CVE-2026-34156Critical· 9.9NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions73CVE-2026-52887Critical· 10.0NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE67GHSA-ghvf-qf6h-g8x5HighNocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution41CVE-2026-112306High· 7.2NocoBase plugin-collection-sql through 2.2.28 SQL Injection via sqlCollection:setFields40CVE-2026-52888Medium· 6.8NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass37
nocobase vulnerabilities
CVEs affecting nocobase, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2026-112306High· 7.2NocoBase plugin-collection-sql through 2.2.28 SQL Injection via sqlCollection:setFields
NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL() through the sqlCollection:setFields action. Attackers holding t…
GHSA-ghvf-qf6h-g8x5HighNocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution
NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution
CVE-2026-52887Critical· 10.0PoCNocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE
NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE
CVE-2026-52888Medium· 6.8NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass
NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass
CVE-2026-34156Critical· 9.9PoCNocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.28, NocoBase's Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with …