Vulnerability · Published Oct 19, 2026 · Assigned by VulnCheck

CVE-2026-112306NocoBase plugin-collection-sql through 2.2.28 SQL Injection via sqlCollection:setFields

High 7.2

In plain English

A high-severity SQL injection in nocobase from nocobase. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)0.3%top 76.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL() through the sqlCollection:setFields action. Attackers holding the collection-sql snippet can replace a benign collection query with dangerous statements executed on reload, reading pg_shadow password hashes or calling pg_read_file.

Affected products (as reported)

Vendor	Product	Versions
nocobase	nocobase	0 – through 2.2.28

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/nocobase/nocobase/issues/10629 issue-tracking
https://github.com/nocobase/nocobase/blob/v2.2.28/packages/plugins/@nocobase/plugin-collection-sql/src/server/resources/sql.ts#L14-L104 technical-description
https://github.com/nocobase/nocobase product
VulnCheck Advisory: NocoBase plugin-collection-sql through 2.2.28 SQL Injection via sqlCollection:setFields third-party-advisory