{"action":"Upgrade @nocobase/plugin-collection-sql to 2.0.62 or later.","affected":[{"fixed":"2.0.62","introduced":"0"},{"fixed":"2.1.0-alpha.46","introduced":"2.1.0-alpha.1"},{"fixed":"2.1.0-beta.45","introduced":"2.1.0-beta.1"}],"component":"@nocobase/plugin-collection-sql","cve_ids":["CVE-2026-52888"],"ecosystem":"npm","epss":0.00469,"exploited":false,"fixed_versions":["2.0.62","2.1.0-alpha.46","2.1.0-beta.45"],"ghsa_id":"GHSA-v8vm-cqh8-q87q","id":"tcs_01M5KGBAEQNN07NBJG6Z0C8M3G","modified_at":"2026-07-28T21:01:37.678030747Z","published_at":"2026-07-28T20:53:08Z","references":["https://osv.dev/vulnerability/GHSA-v8vm-cqh8-q87q","https://github.com/nocobase/nocobase/security/advisories/GHSA-v8vm-cqh8-q87q","https://nvd.nist.gov/vuln/detail/CVE-2026-52888","https://github.com/nocobase/nocobase/pull/9683","https://github.com/nocobase/nocobase/commit/4aecb60d151a9002004dcf984f63d62f17a6cb45","https://github.com/nocobase/nocobase/commit/87c548969ce9258dd7f0d9571c9453ae10bc3fc4","https://github.com/nocobase/nocobase","https://github.com/nocobase/nocobase/releases/tag/v2.0.62","https://github.com/nocobase/nocobase/releases/tag/v2.1.0-alpha.46"],"severity":{"label":"medium","score":6.8},"sources":[{"source":"osv","source_id":"GHSA-v8vm-cqh8-q87q","url":"https://osv.dev/vulnerability/GHSA-v8vm-cqh8-q87q"}],"summary":"NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass"}