CVE-2026-41478
Description
Saltcorn is an extensible, open source, no-code database application builder. Prior to 1.4.6, 1.5.6, and 1.6.0-beta.5, a SQL injection vulnerability in Saltcorn’s mobile-sync routes allows any authenticated low-privilege user with read access to at least one table to inject arbitrary SQL through sync parameters. This can lead to full database exfiltration, including admin password hashes and configuration secrets, and may also enable database modification or destruction depending on the backend. This vulnerability is fixed in 1.4.6, 1.5.6, and 1.6.0-beta.5.
How to fix
- saltcorn saltcorn1.4.6, 1.5.6 or later
- @saltcorn/server1.4.6, 1.5.6, 1.6.0-beta.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| saltcorn saltcorn | v < 1.4.6, 1.5.0 ≤ v < 1.5.6, 1.6.0 | 1.4.6, 1.5.6 |
| @saltcorn/servernpm | v < 1.4.6, 1.5.0-beta.0 ≤ v < 1.5.6, 1.6.0-alpha.0 ≤ v < 1.6.0-beta.5 | 1.4.6, 1.5.6, 1.6.0-beta.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.