NocoBase, an AI‑powered no‑code platform, allows users to build workflows that execute SQL statements through a plugin. In versions before 2.0.30 the workflow SQL node concatenates template variables directly into raw SQL strings without input validation, escaping, or prepared statement usage. This defect enables any user who can supply values for template variables in a workflow trigger to inject arbitrary SQL. The injected code can read, modify, or delete records, potentially exposing sensitive business data, corrupting application state, or facilitating further attacks against the database.

The vulnerability affects the NocoBase platform, specifically the plugin‑workflow‑sql component. All deployments running a version older than 2.0.30 are susceptible. The issue has been addressed in release 2.0.30, which replaces unsafe string concatenation with safe parameter handling.

The CVSS score of 8.5 classifies this as a high‑impact flaw, and the EPSS score of less than 1% indicates that exploitation is currently rare. The vulnerability has not been cataloged in CISA’s KEV list. The attack vector can be inferred to require a user who can trigger a workflow that contains template variables sourced from user‑controlled data; thus, an authenticated or privileged user with workflow creation rights could exploit it. Exploitation would allow unauthorized data access or manipulation via the target database.