NocoBase Has SQL Injection via template variable substitution in workflow SQL node
Date: 2026-04
Affected: npm/@nocobase/plugin-workflow-sql
Attack vector: sql-injection
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-34825
CWE: CWE-89
CVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N)

## Summary NocoBase <= 2.0.8 `plugin-workflow-sql` substitutes template variables directly into raw SQL strings via `getParsedValue()` without parameterization or escaping. Any user who triggers a workflow containing a SQL node with template variables from user-controlled data can inject arbitrary SQL. ## Affected Versions - Affected: all versions through 2.0.8 ## Details The `SQLInstruction` in `packages/plugins/@nocobase/plugin-workflow-sql/src/server/SQLInstruction.ts` line 28 processes SQL templates: ```typescript // SQLInstruction.ts:28 const sql = processor.getParsedValue(node.config.sql || '', node.id).trim(); ``` Then executes the resulting string directly: ```typescript // SQLInstruction.ts:35 const [result] = await collectionManager.db.sequelize.query(sql, { transaction: this.workflow.useDataSourceTransaction(dataSourceName, processor.transaction), }); ``` `getParsedValue()` performs simple string substitution of `{{$context.data.fieldName}}` placeholders with values from the workflow trigger data. No escaping, quoting, or parameterized binding is applied. When an admin creates a SQL node with a template like: ```sql SELECT * FROM users WHERE nickname = '{{$context.data.nickname}}' ``` Any user who triggers the workflow with a crafted value can break out of the string literal and inject arbitrary SQL. ## Proof of Concept 1. Login as admin 2. Create a collection-trigger workflow on the `users` table (mode: after create) 3. Add a SQL node with: ```sql S


Mitigations:

Architectural layers (MAESTRO):