CVE-2026-41640

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.39, the queryParentSQL() function in the core database package constructs a recursive CTE query by joining nodeIds with string concatenation instead of using parameterized queries. The nodeIds array contains primary key values read from database rows. An attacker who can create a record with a malicious string primary key can inject arbitrary SQL when any subsequent request triggers recursive eager loading on that collection. This issue has been patched in version 2.0.39.

• CWE-89

• https://github.com/nocobase/nocobase/commit/202e2b8efe44ba90adbf1087f6f70881ff947604Patch
• https://github.com/nocobase/nocobase/pull/9133Issue Tracking, Patch
• https://github.com/nocobase/nocobase/releases/tag/v2.0.39Patch, Release Notes
• https://github.com/nocobase/nocobase/security/advisories/GHSA-4948-f92q-f432Exploit, Mitigation, Vendor Advisory
• https://github.com/nocobase/nocobase/security/advisories/GHSA-4948-f92q-f432Exploit, Mitigation, Vendor Advisory

Published

May 7, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4162The Gravity SMTP plugin for WordPress is vulnerable to Missi…7.1
• CVE-2026-4163A vulnerability was detected in Wavlink WL-WN579A3 220323. T…9.8
• CVE-2026-41635Apache MINA's AbstractIoBuffer.resolveClass() contains two b…9.8
• CVE-2026-41636Uncontrolled Recursion vulnerability in Apache Thrift Node.j…7.5
• CVE-2026-41637In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, cli…3.7
• CVE-2026-4164A flaw has been found in Wavlink WL-WN578W2 221110. Impacted…9.8
• CVE-2026-41641NocoBase is an AI-powered no-code/low-code platform for buil…7.2
• CVE-2026-41642GoBGP is an open source Border Gateway Protocol (BGP) implem…7.5
• CVE-2026-41643GoBGP is an open source Border Gateway Protocol (BGP) implem…7.5
• CVE-2026-41644monetr is a budgeting application for recurring expenses. Pr…7.1
• CVE-2026-41645Nuclei is a vulnerability scanner built on a simple YAML-bas…5.3
• CVE-2026-41646Nuclei is a vulnerability scanner built on a simple YAML-bas…5.5