Description
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.0.61, NocoBase @nocobase/plugin-notification-in-app-message exposed GET /api/myInAppChannels:list, where the filter[latestMsgReceiveTimestamp][$lt] value was inserted into a Sequelize.literal() template string without escaping or parameter binding, allowing a signed-up authenticated user to run stacked PostgreSQL statements and potentially execute commands with COPY ... TO PROGRAM. This vulnerability is fixed in 2.0.61.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nocobase | nocobase | < 2.0.61 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
pentrestion/nocobase-cve-2026-52887 ★ 0 · Oct 21, 2026
NocoBase security research and exploitation notes for CVE-2026-52887, structured for documentation and reproduction scripts.
-
BiiTts/CVE-2026-52887-NocoBase-SQLi-RCE ★ 0 · Aug 3, 2026
CVE-2026-52887 — NocoBase SQL injection -> PostgreSQL-superuser RCE (myInAppChannels:list filter, CVSS 10.0). Author PoC + source analysis + docker lab.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @nocobase/plugin-notification-in-app-message | < 2.0.61 | 2.0.61 | GHSA-p849-8hwh-84j9 |