CVE-2026-52888
Security Vulnerability Report: Sensitive Data Exposure via SQL Blacklist Bypass
Summary
The checkSQL() function in plugin-collection-sql implements a keyword-based blacklist to prevent dangerous SQL queries from being executed through the SQL Collection feature. However, the blacklist is incomplete: it only checks for a subset of dangerous PostgreSQL system functions and does not restrict access to sensitive system catalog tables such as pg_shadow, pg_roles, or pg_stat_activity.
An authenticated user with the admin role can exploit this to dump PostgreSQL password hashes (pg_shadow), read all NocoBase user credentials (hashed passwords from the users table), and enumerate the full database schema — all data that admin users should never be able to access through the application interface.
Affected Component
File: packages/plugins/@nocobase/plugin-collection-sql/src/server/utils.ts
export const checkSQL = (sql: string) => {
const dangerKeywords = [
// PostgreSQL — BLOCKED
'pg_read_file',
'pg_read_binary_file',
'pg_stat_file',
'pg_ls_dir',
'pg_logdir_ls',
'pg_terminate_backend',
'pg_cancel_backend',
'current_setting',
'set_config',
'pg_reload_conf',
'pg_sleep',
'generate_series',
// MySQL — BLOCKED
'LOAD_FILE',
'BENCHMARK',
'@@global.',
'@@session.',
// SQLite — BLOCKED
'sqlite3_load_extension',
'load_extension',
];
// NOT BLOCKED: pg_shadow, pg_roles, pg_stat_activity,
// information_schema, users table direct access, etc.
sql = sql.trim().split(';').shift();
if (!/^select/i.test(sql) && !/^with([\s\S]+)select([\s\S]+)/i.test(sql)) {
throw new Error('Only supports SELECT statements or WITH clauses');
}
if (dangerKeywords.some((keyword) => sql.toLowerCase().includes(keyword.toLowerCase()))) {
throw new Error('SQL statements contain dangerous keywords');
}
};
The execute action in sql.ts passes user-supplied SQL directly through this insufficient check:
// sql.ts — execute action
execute: async (ctx: Context, next: Next) => {
const { sql } = ctx.action.para
⚡ Watch CVE-2026-52888
Get an email if CVE-2026-52888 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.27% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 19% of all EPSS-scored CVEs.
Advisory coverage (2)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-52888)