GHSA-jp74-mfrx-3qvh
Critical · 9.9CVSS
9.9
EPSS
—
Published
Apr 16, 2026
CISA due date
—
The record
Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId)
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @saltcorn/server | 0 | 1.4.6 |
| npm | @saltcorn/server | 1.5.0-beta.0 | 1.5.6 |
| npm | @saltcorn/server | 1.6.0-alpha.0 | 1.6.0-beta.5 |
Related vulnerabilities
- CVE-2026-41478 Saltcorn is an extensible, open source, no-code database application builder. Same vulnerability
- CVE-2026-42259 Saltcorn is an extensible, open source, no-code database application builder. Also affects @saltcorn/server
- GHSA-f3g8-9xv5-77gv Saltcorn: Open Redirect in `POST /auth/login` due to incomplete `is_relative_url`… Also affects @saltcorn/server
- GHSA-32pv-mpqg-h292 Saltcorn has an Unauthenticated Path Traversal in sync endpoints, allowing arbitrary file… Also affects @saltcorn/server
- CVE-2026-40163 Saltcorn is an extensible, open source, no-code database application builder. Also affects @saltcorn/server
- GHSA-cr3w-cw5w-h3fj Saltcorn's Reflected XSS and Command Injection vulnerabilities can be chained for… Also affects @saltcorn/server
- CVE-2026-87936 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')… CWE-89
- CVE-2026-87938 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')… CWE-89