What is the CVSS score of CVE-2026-52887?

CVE-2026-52887 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of NocoBase are affected by CVE-2026-52887?

NocoBase versions before 2.0.61 contain a critical SQL injection vulnerability in the notification plugin that allows authenticated users to execute arbitrary database queries and operating-system…. A patch is available.

How to fix or mitigate CVE-2026-52887?

Within 24 hours, identify all NocoBase deployments and audit which versions run the @nocobase/plugin-notification-in-app-message plugin; implement network segmentation to restrict database access and deploy WAF rules blocking requests to /api/myInAppChannels:list containing filter parameters. Within 7 days, test upgrade to version 2.0.61 or later in a staging environment, or disable the notification plugin if not operationally required. Within 30 days, complete production upgrade to 2.0.61 or establish a timeline for decommissioning the affected plugin if unneeded.

NocoBase CVE-2026-52887

EUVD-2026-44802 CRITICAL

SQL Injection (CWE-89)

2026-07-15 GitHub_M

GHSA-p849-8hwh-84j9

SQLi PostgreSQL Nocobase

10.0

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable low-complexity SQLi, but a signed-up authenticated account is required so PR:L not PR:N; COPY TO PROGRAM executes OS commands beyond the DBMS, so scope changes with full C/I/A loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 15, 2026 - 22:33 EUVD

Source Code Evidence Fetched

Jul 15, 2026 - 21:03 vuln.today

Analysis Generated

Jul 15, 2026 - 21:03 vuln.today

CVE Published

Jul 15, 2026 - 20:16 cve.org

CRITICAL 10.0

DescriptionCVE.org

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.0.61, NocoBase @nocobase/plugin-notification-in-app-message exposed GET /api/myInAppChannels:list, where the filter[latestMsgReceiveTimestamp][$lt] value was inserted into a Sequelize.literal() template string without escaping or parameter binding, allowing a signed-up authenticated user to run stacked PostgreSQL statements and potentially execute commands with COPY ... TO PROGRAM. This vulnerability is fixed in 2.0.61.

Articles & Coverage 1

News Critical SQL Injection in NocoBase In-App Messaging Plugin - CVE-2026-52887 Jul 15, 2026

AnalysisAI

SQL injection in NocoBase's @nocobase/plugin-notification-in-app-message (before 2.0.61) lets any signed-up authenticated user reach GET /api/myInAppChannels:list and inject into the filter[latestMsgReceiveTimestamp][$lt] parameter, which is concatenated into a Sequelize.literal() template with no escaping or parameter binding. Because PostgreSQL permits stacked statements through this sink, an attacker can run arbitrary SQL and escalate to operating-system command execution via COPY ... TO PROGRAM. No public exploit identified at time of analysis and the flaw is not in CISA KEV, but the code fix and regression tests are public in the vendor commit, and the vendor rates it CVSS 10.0.

Technical ContextAI

NocoBase is an open-source no-code/low-code platform built on Node.js and the Sequelize ORM, backed here by PostgreSQL. The vulnerable endpoint filters in-app notification channels by the timestamp of the latest received message. Instead of passing the user-supplied $lt value as a bound parameter, the plugin embedded it inside a Sequelize.literal() call - a raw-SQL escape hatch that Sequelize inserts verbatim into the generated query. This is a textbook CWE-89 (SQL Injection): untrusted input crosses into a raw-SQL string. The severity is amplified by two PostgreSQL-specific behaviors: the driver's support for stacked/multi-statement queries (allowing '...; <attacker SQL>') and the COPY ... TO PROGRAM feature, which executes shell commands on the database server host, turning a data-layer injection into remote command execution. The affected component per CPE is cpe:2.3:a:nocobase:nocobase across all versions prior to the fix.

RemediationAI

Vendor-released patch: 2.0.61 - upgrade NocoBase to 2.0.61 or later, which replaces the unsafe Sequelize.literal() concatenation with validated/parameterized handling and rejects non-numeric timestamp input (see the release at https://github.com/nocobase/nocobase/releases/tag/v2.0.61 and advisory GHSA-p849-8hwh-84j9). If you cannot patch immediately, reduce exposure by disabling or unloading the in-app message notification plugin (removes the vulnerable endpoint but breaks in-app notifications), disabling public user self-signup so untrusted accounts cannot obtain the authenticated access the attack needs, and restricting network access to the NocoBase instance to trusted users. At the PostgreSQL layer, run the database service account as a low-privilege, non-superuser role to blunt COPY ... TO PROGRAM (note superuser or pg_execute_server_program membership is required for TO PROGRAM, so removing it prevents the RCE escalation even if injection occurs); these controls limit but do not fully eliminate SQL-injection data exposure, so patching remains the priority.