The vulnerability is an SQL injection flaw in the plugin-collection-sql module of NocoBase, where the checkSQL() validation is bypassed in the sqlCollection:setFields action. This allows a user with sufficient privileges to inject arbitrary SQL commands that execute when the collection is reloaded, enabling the attacker to read restricted system tables like pg_shadow that contain password hashes or to invoke functions such as pg_read_file. The weakness corresponds to CWE-89 and results in confidential data disclosure and potential credential compromise.

This flaw affects NocoBase’s plugin‑collection‑sql up to and including version 2.2.28. Any deployment of NocoBase using this plugin package and running that version is susceptible.

The CVSS score of 8.6 indicates high severity, and while a current EPSS score is not available, the lack of listing in the CISA KEV catalog does not reduce the inherent risk. The attack requires a privileged user with access to the plugin’s snippet editor; the attacker can then inject harmful SQL that runs with the application’s database privileges, allowing data exfiltration. Given the potential for credential theft and the likely ease of exploitation for an insider or a compromised account, the risk to affected systems is significant and warrants urgent remediation.