NocoBase, an AI‑powered low‑code platform, contains a flaw where the queryParentSQL() function builds a recursive CTE query by concatenating nodeIds into a string rather than using parameterized inputs. An attacker who can create a record with a specially crafted string as its primary key can inject arbitrary SQL. When any later request triggers recursive eager loading on that collection, the malicious string becomes part of the executed query, allowing the attacker to run arbitrary commands under the database user. This vulnerability can compromise confidentiality, integrity, and availability of the database, potentially leading to data exfiltration, tampering, or denial of service.

The flaw exists in all NocoBase releases prior to v2.0.39. Version 2.0.39 introduces parameterized queries for the recursive CTE, eliminating the injection path. All installations running v2.0.38 or earlier should verify their version and apply the patch as soon as possible.

The CVSS score of 7.5 classifies the vulnerability as high severity, and an EPSS score of 4% indicates a moderate likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves creating a record with a malicious primary key through any interface that permits record creation—such as REST APIs or web forms—a prerequisite that the attacker can then trigger the vulnerable recursive loading. Successful exploitation would give the attacker arbitrary SQL execution against the application database.