CVE-2026-41478
Critical · 9.9CVSS
9.9
EPSS
0.4%
Published
Apr 24, 2026
CISA due date
—
The record
Saltcorn is an extensible, open source, no-code database application builder. Prior to 1.4.6, 1.5.6, and 1.6.0-beta.5, a SQL injection vulnerability in Saltcorn’s mobile-sync routes allows any authenticated low-privilege user with read access to at least one table to inject arbitrary SQL through sync parameters. This can lead to full database exfiltration, including admin password hashes and configuration secrets, and may also enable database modification or destruction depending on the backend. This vulnerability is fixed in 1.4.6, 1.5.6, and 1.6.0-beta.5.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @saltcorn/server | 0 | 1.4.6 |
| npm | @saltcorn/server | 1.5.0-beta.0 | 1.5.6 |
| npm | @saltcorn/server | 1.6.0-alpha.0 | 1.6.0-beta.5 |
Related vulnerabilities
- GHSA-jp74-mfrx-3qvh Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId) Same vulnerability
- CVE-2026-42259 Saltcorn is an extensible, open source, no-code database application builder. Also affects @saltcorn/server
- GHSA-f3g8-9xv5-77gv Saltcorn: Open Redirect in `POST /auth/login` due to incomplete `is_relative_url`… Also affects @saltcorn/server
- GHSA-32pv-mpqg-h292 Saltcorn has an Unauthenticated Path Traversal in sync endpoints, allowing arbitrary file… Also affects @saltcorn/server
- CVE-2026-40163 Saltcorn is an extensible, open source, no-code database application builder. Also affects @saltcorn/server
- GHSA-cr3w-cw5w-h3fj Saltcorn's Reflected XSS and Command Injection vulnerabilities can be chained for… Also affects @saltcorn/server
- CVE-2026-87936 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')… CWE-89
- CVE-2026-87938 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')… CWE-89