CVE-2026-52887
CriticalCVSS 10.0Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
The @nocobase/plugin-notification-in-app-message plugin in NocoBase prior to 2.0.61 contains an SQL injection vulnerability via the GET /api/myInAppChannels:list endpoint. The filter[latestMsgReceiveTimestamp][$lt] parameter is directly inserted into a Sequelize.literal() template without sanitization, allowing an authenticated user to execute malicious PostgreSQL queries, potentially including system commands via COPY ... TO PROGRAM.
Risk Assessment
An authenticated attacker can execute arbitrary SQL queries on the database, and in extreme cases run system commands on the server, leading to full compromise of the application and data.
Recommendation
Immediately upgrade NocoBase to version 2.0.61 or later. If upgrading is not possible, restrict access to the /api/myInAppChannels:list endpoint to trusted users only.
Original NVD description (English source)
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.0.61, NocoBase @nocobase/plugin-notification-in-app-message exposed GET /api/myInAppChannels:list, where the filter[latestMsgReceiveTimestamp][$lt] value was inserted into a Sequelize.literal() template string without escaping or parameter binding, allowing a signed-up authenticated user to run stacked PostgreSQL statements and potentially execute commands with COPY ... TO PROGRAM. This vulnerability is fixed in 2.0.61.