Critical, CVSS 10.0npmAmendedPublished
NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE
CVE-2026-52887 · GHSA-p849-8hwh-84j9
- Affected
- npm @nocobase/plugin-notification-in-app-message <= 2.0.60
- Fixed in
- 2.0.61· Vendor fix available
- Issue
- GET /api/myInAppChannels:list accepts a structured filter query parameter. The handler for the latestMsgReceiveTimestamp field splices the $lt value directly into a Sequelize.literal() template string with no escape, type cast, or parameter binding. The action ACL is loggedIn, so any authenticated account reaches it. The default auth-basic authenticator ships allowSignUp: true, so the account is obtainable anonymously. The injection is reachable with the URL parameter filter[latestMsgReceiveTimestamp][$lt]=<expression. The pg driver in front of Sequelize accepts stacked statements, so the chain extends from boolean and timing oracles to multi-statement payloads. The shipped docker-compose.yml creates the DB role nocobase on a stock postgres:16 image, which assigns the rolsuper attribute by default. COPY ... TO PROGRAM '...' therefore runs shell commands as uid=999(postgres) inside the database container. Result: any anonymous visitor signs up, signs in, and exfiltrates…
Recommended action: Upgrade to 2.0.61 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.