Description
A critical SQL injection vulnerability in Saltcorn’s mobile-sync routes allows any authenticated low-privilege user with read access to at least one table to inject arbitrary SQL through sync parameters.
Recommendation
Update the @saltcorn/server package to the latest compatible version. Followings are version details:
Affected version(s): **>= 1.6.0-alpha.0, < 1.6.0-beta.5 >= 1.5.0-beta.0, < 1.5.6 < 1.4.6** Patched version(s): **1.6.0-beta.5 1.5.6 1.4.6**
References
Could your website be exposed too?
SmartScanner can check your website for Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId) and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Saltcorn has an Unauthenticated Path Traversal in sync endpoints, allowing arbitrary file write and directory read - CVE-2026-40163
- Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that - CVE-2026-33468
- Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys. - CVE-2026-33442
- @nocobase/database has SQL Injection via String Concatenation through Recursive Eager Loading - CVE-2026-41640
You might also like:
See something that needs correcting? Let us knowUpdated April 27, 2026