Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId)

Description

A critical SQL injection vulnerability in Saltcorn’s mobile-sync routes allows any authenticated low-privilege user with read access to at least one table to inject arbitrary SQL through sync parameters.

Recommendation

Update the @saltcorn/server package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 1.6.0-alpha.0, < 1.6.0-beta.5

  >= 1.5.0-beta.0, < 1.5.6

  < 1.4.6**

• Patched version(s): **1.6.0-beta.5

  1.5.6

  1.4.6**

References

• GHSA-jp74-mfrx-3qvh
• CVE-2026-41478
• CWE-89
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Saltcorn has an Unauthenticated Path Traversal in sync endpoints, allowing arbitrary file write and directory read - CVE-2026-40163
• Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that - CVE-2026-33468
• Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys. - CVE-2026-33442
• @nocobase/database has SQL Injection via String Concatenation through Recursive Eager Loading - CVE-2026-41640

You might also like:

44 New SQL Injection Tests for WordPress in SmartScanner 1.8

How do hackers hack websites?

Update Cheat Sheet for Developers

Tags:

npm

@saltcorn/server