CVE-2025-13877
MediumCVSS 5.6Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
A vulnerability was detected in nocobase up to 1.9.4/2.0.0-alpha.37. An unknown function in the file nocobase\packages\core\auth\src\base\jwt-service.ts of the JWT Service component allows manipulation of the API_KEY argument, resulting in the use of a hard-coded cryptographic key. The attack can be launched remotely but requires high complexity and is difficult to exploit. The exploit is now public.
Risk Assessment
The use of a hard-coded cryptographic key could allow an attacker to forge JWT tokens, potentially leading to unauthorized access to the system.
Recommendation
It is recommended to upgrade to a version that fixes this vulnerability and avoid using hard-coded keys in code.
Other vulnerabilities in nocobase
See all- CVE-2026-41641High
In NocoBase prior to version 2.0.39, the checkSQL() validation function was not applied on the sqlCollection:update endpoint, allowing attackers with collection management permissions to inject arbitrary SQL and exfiltrate data.
- CVE-2026-52887Critical
The @nocobase/plugin-notification-in-app-message plugin in NocoBase prior to 2.0.61 contains an SQL injection vulnerability via the GET /api/myInAppChannels:list endpoint. The filter[latestMsgReceiveTimestamp][$lt] parameter is directly inserted into a Sequelize.literal() template without sanitization, allowing an authenticated user to execute malicious PostgreSQL queries, potentially including system commands via COPY ... TO PROGRAM.
- CVE-2026-34156Critical
NocoBase prior to version 2.0.28 contains a vulnerability in the Workflow Script Node that allows an authenticated attacker to escape the Node.js vm sandbox and achieve Remote Code Execution as root via prototype chain traversal using console._stdout and console._stderr.
- CVE-2026-84701Medium
NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Attackers can write arbitrary markup through the collection API that executes in the browsers of all users viewing the affected record.
- CVE-2026-55410Medium
A vulnerability in NocoBase prior to version 2.1.19 allowed command injection during PostgreSQL backup restoration. An attacker with backup management privileges could inject malicious values into the database.schema field in _metadata.json, which was then interpolated into a shell command executed via child_process.exec().
- CVE-2026-52888Medium
In NocoBase version 2.0.59 and earlier, the checkSQL() function in the collection-sql plugin fails to block access to PostgreSQL system catalog tables such as pg_shadow, pg_roles, and pg_stat_activity. An admin-role user can read password hashes and database metadata through the SQL Collection feature.
- CVE-2026-58468Medium
NocoBase up to version 2.1.20 contains a server-side request forgery (SSRF) vulnerability in the serverRequest wrapper. It allows authenticated administrators to issue arbitrary outbound HTTP requests by supplying malicious URLs to workflow request nodes, custom request action buttons, or the AI plugin.
- CVE-2026-34825Medium
NocoBase prior to version 2.0.30 contains a vulnerability in the plugin-workflow-sql plugin, which substitutes template variables directly into raw SQL strings via getParsedValue() without parameterization or escaping. Any user who triggers a workflow containing a SQL node with template variables from user-controlled data can inject arbitrary SQL.
Original NVD description (English source)
A vulnerability was detected in nocobase up to 1.9.4/2.0.0-alpha.37. The affected element is an unknown function of the file nocobase\packages\core\auth\src\base\jwt-service.ts of the component JWT Service. The manipulation of the argument API_KEY results in use of hard-coded cryptographic key . The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is described as difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.