NocoBase plugin-collection-sql: SQL injection via sqlCollection:setFields
Summary
The NocoBase plugin @nocobase/plugin-collection-sql up to and including 2.2.28 allows privileged users to store unvalidated SQL by bypassing the checkSQL() check through the sqlCollection:setFields action. An attacker holding the collection-sql snippet can replace a benign collection query with dangerous statements that run when the collection is reloaded. This can expose database password hashes (pg_shadow) or allow calls to pg_read_file.
Affected
- @nocobase/plugin-collection-sql through 2.2.28 (per CVE record: affected 0 to <= 2.2.28)
Fixed in
Unknown. No fixed version has been confirmed.
Workaround
- Restrict collection-management and SQL-snippet permissions to the smallest possible group of users
- Review existing SQL-based collections for unexpected or altered SQL
- Run the NocoBase database role with least privilege and no unnecessary access to server files or system catalogues
- Keep NocoBase off the public internet or restrict access via SSO/VPN until a fix is confirmed
Exploitation
- Known exploited: No (per current sources)
- Public proof of concept: none found; absence of evidence, not confirmed absence
- Attack requires network access and high privileges (CVSS 4.0 PR:H), no user interaction
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total
Our recommendation
- Check whether NocoBase with @nocobase/plugin-collection-sql up to 2.2.28 is in use and whether it is reachable from the internet
- Limit who can manage collections and SQL snippets, and review admin accounts
- Audit existing SQL collections for unexpected changes
- Apply least privilege to the database role
- Monitor GitHub issue #10629 and new NocoBase releases, and upgrade as soon as a fixed version is confirmed
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- NocoBase GitHub issue #10629 github.com
- VulnCheck advisory www.vulncheck.com
- Vulnerable source file at v2.2.28 github.com
- NocoBase GitHub repository github.com
- OSV entry CVE-2026-112306 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:47.
Original description (NVD)
NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL() through the sqlCollection:setFields action. Attackers holding the collection-sql snippet can replace a benign collection query with dangerous statements executed on reload, reading pg_shadow password hashes or calling pg_read_file.
NVD references (4)
- https://github.com/nocobase/nocobase
- https://github.com/nocobase/nocobase/blob/v2.2.28/packages/plugins/@nocobase/plugin-collection-sql/src/server…
- https://github.com/nocobase/nocobase/issues/10629
- https://www.vulncheck.com/advisories/nocobase-plugin-collection-sql-through-2.2.28-sql-injection-via-sqlcolle…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.