Live › vulnerability › CVE-2026-112306
Go to dashboardThe @nocobase/plugin-collection-sql plugin through 2.2.28 lets a privileged user store SQL that bypasses the checkSQL() validation via the sqlCollection:setFields action. The stored query runs on reload, so an attacker can read database password hashes (pg_shadow) or read server files (pg_read_file).
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check the installed version of @nocobase/plugin-collection-sql in package.json or the lockfile; versions through 2.2.28 are affected.
2.2.28; the sources do not name the fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL() through the sqlCollection:setFields action. Attackers holding the collection-sql snippet can replace a benign collection query with dangerous statements executed on reload, reading pg_shadow password hashes or calling pg_read_file.
This page as .md · .json · in your agent: get_signal("CVE-2026-112306")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.