NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE

published 2026-07-15 3 mo ago modified 2026-07-31 3 mo ago also GHSA-p849-8hwh-84j9 , EUVD-2026-44802

cvss: 10.0; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.9%; EPSS 0.9% chance of exploitation in 30 days, percentile 59%
public exploits: 0; none known

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.0.61, NocoBase @nocobase/plugin-notification-in-app-message exposed GET /api/myInAppChannels:list, where the filter[latestMsgReceiveTimestamp][$lt] value was inserted into a Sequelize.literal() template string without escaping or parameter binding, allowing a signed-up authenticated user to run stacked PostgreSQL statements and potentially execute commands with COPY ... TO PROGRAM. This vulnerability is fixed in 2.0.61.

Patch / fix

fixed in 1 links 3

npm @nocobase/plugin-notification-in-app-message 2.0.61

github.com/nocobase/nocobase@68d64e3 commit
github.com/nocobase/nocobase#9630 pull request
github.com/nocobase/nocobase/releases/tag/v2.0.61 release

CISA SSVC

Exploitation: Proof of concept is public
Automatable: yes
Technical impact: total
Assessed: 3 mo ago (2026-07-20)

Exploit prediction

0.89% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/nocobase/nocobase/security/advisories/GHSA-p849-8hwh-84j9 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
GitHub	3.1	10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
npm	@nocobase/plugin-notification-in-app-message	<2.0.61	2.0.61

Affected products

nocobase nocobase

Classification

Weakness

CWE-89 Improper Neutralization of Special Elements used in an SQL Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary