CVE-2026-34825
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
NocoBase prior to version 2.0.30 contains a vulnerability in the plugin-workflow-sql plugin, which substitutes template variables directly into raw SQL strings via getParsedValue() without parameterization or escaping. Any user who triggers a workflow containing a SQL node with template variables from user-controlled data can inject arbitrary SQL.
Risk Assessment
Risk of SQL injection, which could lead to unauthorized database access, data theft, or data modification.
Recommendation
Update NocoBase to version 2.0.30 or later. Restrict access to workflows with SQL nodes to trusted users.
Original NVD description (English source)
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.30, NocoBase plugin-workflow-sql substitutes template variables directly into raw SQL strings via getParsedValue() without parameterization or escaping. Any user who triggers a workflow containing a SQL node with template variables from user-controlled data can inject arbitrary SQL. This issue has been patched in version 2.0.30.