DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-52887: CVE-2026-52887: Critical SQL Injection and Remote Code Execution in NocoBase

#security #cve #cybersecurity

CVE-2026-52887: Critical SQL Injection and Remote Code Execution in NocoBase

Vulnerability ID: CVE-2026-52887
CVSS Score: 10.0
Published: 2026-07-31

A critical SQL injection vulnerability exists in the @nocobase/plugin-notification-in-app-message plugin of NocoBase prior to version 2.0.61. The flaw is caused by direct string interpolation of user-controlled input into a Sequelize.literal() query, allowing authenticated users to execute stacked PostgreSQL queries and achieve remote code execution on the underlying database server.

TL;DR

SQL injection via Sequelize.literal in NocoBase's in-app message plugin allows authenticated attackers to execute stacked queries and achieve OS command execution via PostgreSQL.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-89
  • Attack Vector: Network (AV:N)
  • CVSS Score: 10.0 (Critical)
  • EPSS Score: 0.00593 (Percentile: 44.98%)
  • Impact: Remote Code Execution (RCE) / Full Database Compromise
  • Exploit Status: Proof of Concept (PoC)
  • KEV Status: Not Listed

Affected Systems

  • NocoBase installations prior to version 2.0.61 running the @nocobase/plugin-notification-in-app-message plugin
  • @nocobase/plugin-notification-in-app-message: < 2.0.61 (Fixed in: 2.0.61)

Code Analysis

Commit: 68d64e3

Fix SQL injection vulnerability in notification-in-app-message plugin by adding validation and parameterization to timestamp parameter.

Commit: 17ae6fd

Refactor user notification handlers and apply security bounds.

Exploit Details

  • GitHub Advisory: Official Security Advisory detailing technical mechanisms and mitigation routes.

Mitigation Strategies

  • Upgrade NocoBase to version 2.0.61 or later
  • Enforce database least-privilege principles by revoking superuser roles from application accounts
  • Configure WAF rules to drop requests containing non-numeric values in the latestMsgReceiveTimestamp filter

Remediation Steps:

  1. Identify vulnerable NocoBase instances by checking package versions of @nocobase/plugin-notification-in-app-message.
  2. Deploy updated NocoBase v2.0.61 container images or update application packages via npm.
  3. Audit database permissions and run 'ALTER USER' to ensure the database daemon user does not possess SUPERUSER status.
  4. Analyze application logs for requests containing special characters in query string variables.

References

Read the full report for CVE-2026-52887 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)