CVE-2026-41641
1 advisory.
npm/@nocobase/plugin-collection-sql CVE-2026-41641: high 7.2
@nocobase/plugin-collection-sql: SQL Validation Bypass Through Missing `checkSQL` Call
Action: Upgrade @nocobase/plugin-collection-sql to 2.0.39 or later.
npm i @nocobase/plugin-collection-sql@2.0.39Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.0.39 | - |
Fixed versions
| 2.0.39 |
Sources
- osv: GHSA-wrwh-c28m-9jjh
- https://github.com/nocobase/nocobase/security/advisories/GHSA-wrwh-c28m-9jjh
- https://nvd.nist.gov/vuln/detail/CVE-2026-41641
- https://github.com/nocobase/nocobase/pull/9134
- https://github.com/nocobase/nocobase/commit/851aee543efa894142e0f7be03eb55d9cec06a91
- https://github.com/nocobase/nocobase
- https://github.com/nocobase/nocobase/releases/tag/v2.0.39
CVE-2026-41641 · published · modified · JSON