MEDIUM 6.8 GitHub
CVE-2026-52888
NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass
# Security Vulnerability Report: Sensitive Data Exposure via SQL Blacklist Bypass
## Summary
The `checkSQL()` function in `plugin-collection-sql` implements a **keyword-based blacklist** to prevent dangerous SQL queries from being executed through the SQL Collection feature. However, the blacklist is **incomplete**: it only checks for a subset of dangerous PostgreSQL system functions and **does not restrict access to sensitive system catalog tables** such as `pg_shadow`, `pg_roles`, or `pg_sta
Affected Products
- npm/@nocobase/plugin-collection-sql < 2.0.62
- npm/@nocobase/plugin-collection-sql >= 2.1.0-alpha.1, < 2.1.0-alpha.46
- npm/@nocobase/plugin-collection-sql >= 2.1.0-beta.1, < 2.1.0-beta.45
References
- https://github.com/advisories/GHSA-v8vm-cqh8-q87q
- https://github.com/nocobase/nocobase/security/advisories/GHSA-v8vm-cqh8-q87q
- https://nvd.nist.gov/vuln/detail/CVE-2026-52888
- https://github.com/nocobase/nocobase/pull/9683
This medium severity vulnerability with a CVSS score of 6.8 was published on 2026-07-28 via GitHub. Affected: npm/@nocobase/plugin-collection-sql < 2.0.62, npm/@nocobase/plugin-collection-sql >= 2.1.0-alpha.1, < 2.1.0-alpha.46, npm/@nocobase/plugin-collection-sql >= 2.1.0-beta.1, < 2.1.0-beta.45.
vulnfeed aggregates 9166 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.