HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-41640 — NocoBase is an AI-powered no-code/low-code platform for building business applic...

·Source: NIST NVD

Updated:

Executive Summary

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.39, the queryParentSQL() function in the core database package constructs a recursive CTE query by joining nodeIds with string concatenation instead of using parameterized queries. The nodeIds array contains primary key values read from database rows. An attacker wh

Analysis

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.39, the queryParentSQL() function in the core database package constructs a recursive CTE query by joining nodeIds with string concatenation instead of using parameterized queries. The nodeIds array contains primary key values read from database rows. An attacker who can create a record with a malicious string primary key can inject arbitrary SQL when any subsequent request triggers recursive eager loading on that collection. This issue has been patched in version 2.0.39. CVSS Score: 7.5. Published: 2026-05-07T04:16:28.277.

Indicators of Compromise (1)

CVE (1)
CVE-2026-41640
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on May 7, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

Proxying the Unproxyable? Sending EXE traffic to a Proxy, (Wed, May 13th)

.. if “unproxyable” is a word that is ..

SANS ISC
MEDIUMVulnerability

Palm payments startup Five ID raises $6 million

Five ID, a London-based startup founded by two former Revoluters, has raised $6 million to support the launch of its palm-based biometric payment system.

Finextra
MEDIUMVulnerability

BaFin preps IT spotlight inspections amidst growing AI cybersecurity risks

German financial regulator BaFin is setting up a division to carry out targeted inspections at firms as it seeks to ward of the threat of AI-enabled cyber attacks on the sector.

Finextra