@nocobase/database has SQL Injection via String Concatenation through Recursive Eager Loading

Description

The queryParentSQL() function in the core database package constructs a recursive CTE query by joining nodeIds with string concatenation instead of using parameterized queries. The nodeIds array contains primary key values read from database rows.

Recommendation

Update the @nocobase/database package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.0.39
• Patched version(s): 2.0.39

References

• GHSA-4948-f92q-f432
• CVE-2026-41640
• CWE-89
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that - CVE-2026-33468
• Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys. - CVE-2026-33442
• Parse Server has SQL Injection through aggregate and distinct field names in PostgreSQL adapter - CVE-2026-33539
• Payload has an SQL Injection via Query Handling - CVE-2026-34747

You might also like:

44 New SQL Injection Tests for WordPress in SmartScanner 1.8

How do hackers hack websites?

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@nocobase/database