Vulnerability	Vulnerable Version
H SQL Injection @nocobase/database is a Affected versions of this package are vulnerable to SQL Injection via the `queryParentSQL` function. An attacker can execute arbitrary SQL commands, extract sensitive data, modify or delete database records, and potentially cause denial of service by injecting malicious input into string-type primary key fields when recursive eager loading is triggered on a tree collection. This is only exploitable if the attacker has permission to create records in a collection with string-type primary keys and recursive eager loading is enabled. How to fix SQL Injection? Upgrade `@nocobase/database` to version 2.0.39 or higher.	<2.0.39

SQL Injection

@nocobase/database is a

Affected versions of this package are vulnerable to SQL Injection via the queryParentSQL function. An attacker can execute arbitrary SQL commands, extract sensitive data, modify or delete database records, and potentially cause denial of service by injecting malicious input into string-type primary key fields when recursive eager loading is triggered on a tree collection. This is only exploitable if the attacker has permission to create records in a collection with string-type primary keys and recursive eager loading is enabled.

How to fix SQL Injection?

Upgrade @nocobase/database to version 2.0.39 or higher.

<2.0.39

Go back to all versions of this package