https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 14:39:44 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-52888 <p>NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. In 2.0.59 and earlier, NocoBase @nocobase/plugin-collection-sql used the checkSQL() function in packages/plugins/@nocobase/plugin-collection-sql/src/server/utils.ts with an incomplete keyword blacklist that did not restrict PostgreSQL system catalog tables such as pg_shadow, pg_roles, and pg_stat_activity, allowing an admin-role user to read password hashes and database metadata through the SQL Collection feature. This vulnerability is fixed in 2.1.0-alpha.46.</p> <p>NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. In 2.0.59 and earlier, NocoBase @nocobase/plugin-collection-sql used the checkSQL() function in packages/plugins/@nocobase/plugin-collection-sql/src/server/utils.ts with an incomplete keyword blacklist that did not restrict PostgreSQL system catalog tables such as pg_shadow, pg_roles, and pg_stat_activity, allowing an admin-role user to read password hashes and database metadata through the SQL Collection feature. This vulnerability is fixed in 2.1.0-alpha.46.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-52888 https://vulnerability.circl.lu/vuln/ghsa-v8vm-cqh8-q87q <p><strong>Affected:</strong> npm: @nocobase/plugin-collection-sql</p> <p># Security Vulnerability Report: Sensitive Data Exposure via SQL Blacklist Bypass</p> <p>## Summary</p> <p>The `checkSQL()` function in `plugin-collection-sql` implements a **keyword-based blacklist** to prevent dangerous SQL queries from being executed through the SQL Collection feature. However, the blacklist is **incomplete**: it only checks for a subset of dangerous PostgreSQL system functions and **does not restrict access to sensitive system catalog tables** such as `pg_shadow`, `pg_roles`, or `pg_stat_activity`.</p> <p>An authenticated user with the `admin` role can exploit this to **dump PostgreSQL password hashes** (`pg_shadow`), **read all NocoBase user credentials** (hashed passwords from the `users` table), and **enumerate the full database schema** — all data that admin users should never be able to access through the application interface.</p> <p>---</p> <p>## Affected Component</p> <p>**File**: `packages/plugins/@nocobase/plugin-collection-sql/src/server/utils.ts`</p> <p>```typescript export const checkSQL = (sql: string) =&gt; { const dangerKeywords = [ // PostgreSQL — BLOCKED &#39;pg_read_file&#39;, &#39;pg_read_binary_file&#39;, &#39;pg_stat_file&#39;, &#39;pg_ls_dir&#39;, &#39;pg_logdir_ls&#39;, &#39;pg_terminate_backend&#39;, &#39;pg_cancel_backend&#39;, &#39;current_setting&#39;, &#39;set_config&#39;, &#39;pg_reload_conf&#39;, &#39;pg_sleep&#39;, &#39;generate_series&#39;,</p> <p>// MySQL — BLOCKED &#39;LOAD_FILE&#39;, &#39;BENCHMARK&#39;, &#39;@@global.&#39;, &#39;@@session.&#39;,</p> <p>// SQLite — BLOCKED &#39;sqlite3_load_extension&#39;, &#39;load_extension&#39;,…</p> <p><strong>Affected:</strong> npm: @nocobase/plugin-collection-sql</p> <p># Security Vulnerability Report: Sensitive Data Exposure via SQL Blacklist Bypass</p> <p>## Summary</p> <p>The `checkSQL()` function in `plugin-collection-sql` implements a **keyword-based blacklist** to prevent dangerous SQL queries from being executed through the SQL Collection feature. However, the blacklist is **incomplete**: it only checks for a subset of dangerous PostgreSQL system functions and **does not restrict access to sensitive system catalog tables** such as `pg_shadow`, `pg_roles`, or `pg_stat_activity`.</p> <p>An authenticated user with the `admin` role can exploit this to **dump PostgreSQL password hashes** (`pg_shadow`), **read all NocoBase user credentials** (hashed passwords from the `users` table), and **enumerate the full database schema** — all data that admin users should never be able to access through the application interface.</p> <p>---</p> <p>## Affected Component</p> <p>**File**: `packages/plugins/@nocobase/plugin-collection-sql/src/server/utils.ts`</p> <p>```typescript export const checkSQL = (sql: string) =&gt; { const dangerKeywords = [ // PostgreSQL — BLOCKED &#39;pg_read_file&#39;, &#39;pg_read_binary_file&#39;, &#39;pg_stat_file&#39;, &#39;pg_ls_dir&#39;, &#39;pg_logdir_ls&#39;, &#39;pg_terminate_backend&#39;, &#39;pg_cancel_backend&#39;, &#39;current_setting&#39;, &#39;set_config&#39;, &#39;pg_reload_conf&#39;, &#39;pg_sleep&#39;, &#39;generate_series&#39;,</p> <p>// MySQL — BLOCKED &#39;LOAD_FILE&#39;, &#39;BENCHMARK&#39;, &#39;@@global.&#39;, &#39;@@session.&#39;,</p> <p>// SQLite — BLOCKED &#39;sqlite3_load_extension&#39;, &#39;load_extension&#39;,…</p> https://vulnerability.circl.lu/vuln/ghsa-v8vm-cqh8-q87q