{"action":"Upgrade @nocobase/plugin-workflow-request to 2.0.37 or later.","affected":[{"fixed":"2.0.37","introduced":"0"}],"component":"@nocobase/plugin-workflow-request","cve_ids":["CVE-2026-40346"],"ecosystem":"npm","epss":0.00384,"exploited":false,"fixed_versions":["2.0.37"],"ghsa_id":"GHSA-mvvv-v22x-xqwp","id":"tcs_01M5KG1TQ7N6FAPBMY8E3BA5R7","modified_at":"2026-05-14T20:47:41.903716Z","published_at":"2026-04-15T19:43:50Z","references":["https://osv.dev/vulnerability/GHSA-mvvv-v22x-xqwp","https://github.com/nocobase/nocobase/security/advisories/GHSA-mvvv-v22x-xqwp","https://nvd.nist.gov/vuln/detail/CVE-2026-40346","https://github.com/nocobase/nocobase/pull/9079","https://github.com/nocobase/nocobase/commit/2853368243ed07339c62c548b7d475f4eeaada59","https://github.com/nocobase/nocobase","https://github.com/nocobase/nocobase/releases/tag/v2.0.37"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-mvvv-v22x-xqwp","url":"https://osv.dev/vulnerability/GHSA-mvvv-v22x-xqwp"}],"summary":"NocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins"}