Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId)

Description

A critical SQL injection vulnerability in Saltcorn’s mobile-sync routes allows any authenticated low-privilege user with read access to at least one table to inject arbitrary SQL through sync parameters.

Recommendation

Update the @saltcorn/server package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 1.6.0-alpha.0, < 1.6.0-beta.5

  >= 1.5.0-beta.0, < 1.5.6

  < 1.4.6**

• Patched version(s): **1.6.0-beta.5

  1.5.6

  1.4.6**

References

• GHSA-jp74-mfrx-3qvh
• CVE-2026-41478
• CWE-89
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Saltcorn has an Unauthenticated Path Traversal in sync endpoints, allowing arbitrary file write and directory read - CVE-2026-40163
• Drizzle ORM has SQL injection via improperly escaped SQL identifiers - CVE-2026-39356
• Payload has an SQL Injection via Query Handling - CVE-2026-34747
• Parse Server has a SQL injection via query field name when using PostgreSQL - CVE-2026-32234

You might also like:

44 New SQL Injection Tests for WordPress in SmartScanner 1.8

How do hackers hack websites?

Update Cheat Sheet for Developers

Tags:

npm

@saltcorn/server