{"action":"Upgrade @nocobase/plugin-collection-sql to 2.0.39 or later.","affected":[{"fixed":"2.0.39","introduced":"0"}],"component":"@nocobase/plugin-collection-sql","cve_ids":["CVE-2026-41641"],"ecosystem":"npm","epss":0.01833,"exploited":false,"fixed_versions":["2.0.39"],"ghsa_id":"GHSA-wrwh-c28m-9jjh","id":"tcs_01M5KGFYQAFCFENAH7W6H01CZ1","modified_at":"2026-05-08T20:26:25.418245Z","published_at":"2026-04-22T20:07:11Z","references":["https://osv.dev/vulnerability/GHSA-wrwh-c28m-9jjh","https://github.com/nocobase/nocobase/security/advisories/GHSA-wrwh-c28m-9jjh","https://nvd.nist.gov/vuln/detail/CVE-2026-41641","https://github.com/nocobase/nocobase/pull/9134","https://github.com/nocobase/nocobase/commit/851aee543efa894142e0f7be03eb55d9cec06a91","https://github.com/nocobase/nocobase","https://github.com/nocobase/nocobase/releases/tag/v2.0.39"],"severity":{"label":"high","score":7.2},"sources":[{"source":"osv","source_id":"GHSA-wrwh-c28m-9jjh","url":"https://osv.dev/vulnerability/GHSA-wrwh-c28m-9jjh"}],"summary":"@nocobase/plugin-collection-sql: SQL Validation Bypass Through Missing `checkSQL` Call"}