Nocobase vulnerabilities
We track 7 vulnerabilities in Nocobase products across 2 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on November 10, 2026.
Latest Nocobase vulnerabilities
- 7.1 High severity
nocobase: Incorrect Authorization
NocoBase plugin-ai 2.1.0 through 2.2.41 contains an authorization bypass vulnerability in getAccessibleAIEmployee() that lets authenticated users access unassigned AI employees by overriding the role-derived filter with a supplied username. Attackers can use t
- 7.2 High severity
nocobase: Improper Neutralization of Special Elements used in an SQL Command
NocoBase @nocobase/plugin-collection-sql through 2.2.46 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL() through the sqlCollection:setFields action. Attackers holding the collection-sql snipp
- 10.0 Critical severity
nocobase: Improper Neutralization of Special Elements used in an SQL Command
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.0.61, NocoBase @nocobase/plugin-notification-in-app-message exposed GET /api/myInAppChannels:list, where the filter[latestMsgReceiveTime
- 7.2 High severity
nocobase: Improper Neutralization of Special Elements used in an SQL Command
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.39, the checkSQL() validation function that blocks dangerous SQL keywords (e.g., pg_read_file, LOAD_FILE, dblink) is applied o
- 8.8 High severity
nocobase: Improper Neutralization of Special Elements used in an SQL Command
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.39, the queryParentSQL() function in the core database package constructs a recursive CTE query by joining nodeIds with string
- 7.3 High severity
A security flaw has been discovered in nocobase plugin-workflow-javascript up to 2.0.23.
A security flaw has been discovered in nocobase plugin-workflow-javascript up to 2.0.23. This issue affects the function createSafeConsole of the file packages/plugins/@nocobase/plugin-workflow-javascript/src/server/Vm.js. Performing a manipulation results in
- 9.9 Critical severity
nocobase: Improper Control of Dynamically-Managed Code Resources
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.28, NocoBase's Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allowl