The error in the checkSQL function of nocobase v2.1.21 permits an attacker to inject arbitrary SQL commands. This flaw classifies as a classic SQL injection (CWE‑89) and enables the attacker to read or retrieve data that should be protected by the application's access controls. The impact is privilege escalation of data confidentiality, potentially exposing customer records, authentication tokens, or other sensitive database contents.

Affected platforms include the nocobase application version 2.1.21. No additional vendor or product listings are provided by the CNA, and no variant or patch level information beyond the specific release is noted. System administrators should verify the running version and ensure it matches the identified vulnerable release.

The vulnerability carries a CVSS score of 9.8, indicating critical severity. It is not listed in the CISA KEV, and its EPSS score is < 1%, suggesting a low likelihood of exploitation, but the high CVSS remains a significant concern. Because nocobase is a web application, the attack vector is likely remote via crafted HTTP requests to endpoints that invoke checkSQL. No explicit prerequisite or privilege escalation is required beyond application access, so the exploit can be performed by any user able to supply input to the vulnerable function.