nocobase

6 results · Clear filters · Feed

• Medium 4.3
  CVE-2026-79914

  NocoBase: SSRF in customRequests:send via runtime options.url override

  NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Versions 2.1.0 through 2.1.14 contain a server-side request forgery vulnerability in the customRequests:send endpoint. A low-privileged authentica…

  nocobase nocobase @nocobase/plugin-action-custom-request npm
  Nov 10, 2026
• Medium 5.4
  CVE-2026-84701

  NocoBase Rich Text Field Stored Cross-Site Scripting via API

  NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Attackers can write arbitrary markup through the collection API that executes in the browsers of all us…

  nocobase nocobase
  Sep 2, 2026
• Medium 6.7
  CVE-2026-55410

  NocoBase backup restore schema name allows command injection

  NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.1.19, NocoBase @nocobase/plugin-backups restored PostgreSQL backups by interpolating the database.schema value from _metadata.json into…

  nocobase nocobase @nocobase/plugin-backups npm
  Jul 15, 2026
• Medium 6.8
  CVE-2026-52888

  NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass

  NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. In 2.0.59 and earlier, NocoBase @nocobase/plugin-collection-sql used the checkSQL() function in packages/plugins/@nocobase/plugin-collection-sql/s…

  nocobase nocobase @nocobase/plugin-collection-sql npm
  Jul 15, 2026
• Medium 5.5
  CVE-2026-58468

  NocoBase 2.1.20 Server-Side Request Forgery via serverRequest wrapper

  NocoBase through 2.1.20 contains a server-side request forgery vulnerability in the serverRequest wrapper that allows authenticated administrators to issue arbitrary outbound HTTP requests by supplying malicious URLs to workflow request nodes, custom request …

  nocobase nocobase
  Jul 7, 2026
• Medium 6.4
  CVE-2026-40346

  NocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins

  NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.37, NocoBase's workflow HTTP request plugin and custom request action plugin make server-side HTTP requests to user-provided …

  nocobase @nocobase/plugin-workflow-request @nocobase/plugin-workflow-request npm
  Apr 17, 2026