CVE-2026-52887 Details
Description
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.0.61, NocoBase @nocobase/plugin-notification-in-app-message exposed GET /api/myInAppChannels:list, where the filter[latestMsgReceiveTimestamp][$lt] value was inserted into a Sequelize.literal() template string without escaping or parameter binding, allowing a signed-up authenticated user to run stacked PostgreSQL statements and potentially execute commands with COPY ... TO PROGRAM. This vulnerability is fixed in 2.0.61.
A SQL injection vulnerability has been identified in NocoBase versions prior to 2.0.61, specifically within the '@nocobase/plugin-notification-in-app-message' plugin. The issue arises in the 'GET /api/myInAppChannels:list' endpoint, where the 'filter[latestMsgReceiveTimestamp][$lt]' parameter is improperly handled. This flaw enables authenticated users to inject malicious SQL, potentially executing commands on the server via PostgreSQL's COPY ... TO PROGRAM functionality. The vulnerability is present because the timestamp filter is directly interpolated into a SQL query without proper escaping or parameterization, allowing for the execution of stacked SQL statements.
Users are advised to update NocoBase to version 2.0.61 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 15, 2026CISA-ADP
Assessed Jul 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nocobase/nocobase/security/advisories/GHSA-p849-8hwh-84j9 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/nocobase/nocobase/commit/68d64e3fcfb8be2ae4f3bfc9e1ee3f85b87c89ce | [email protected] | Source CodeVendor |
| https://github.com/nocobase/nocobase/releases/tag/v2.0.61 | [email protected] | Release NotesVendor |
| https://github.com/nocobase/nocobase/security/advisories/GHSA-p849-8hwh-84j9 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NocoBase | <= 2.0.60 (semver) |
CPE
Remediation
| |
| NocoBase plugin-notification-in-app-message | <= 2.0.60 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 20, 2026 | CVE Modified | CISA-ADP |
| Jul 15, 2026 | New CVE Received | [email protected] |