NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2026-52887. PoCs published by BiiTts.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2026-52887, a SQL injection vulnerability in NocoBase's @nocobase/plugin-notification-in-app-message (<= 2.0.60) that leads to RCE via PostgreSQL's COPY TO PROGRAM command. The exploit leverages unauthenticated account creation to bypass ACL restrictions and execute arbitrary commands as the postgres OS user.
Description
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.0.61, NocoBase @nocobase/plugin-notification-in-app-message exposed GET /api/myInAppChannels:list, where the filter[latestMsgReceiveTimestamp][$lt] value was inserted into a Sequelize.literal() template string without escaping or parameter binding, allowing a signed-up authenticated user to run stacked PostgreSQL statements and potentially execute commands with COPY ... TO PROGRAM. This vulnerability is fixed in 2.0.61.
Exploits (1)
This repository contains a functional exploit for CVE-2026-52887, a SQL injection vulnerability in NocoBase's @nocobase/plugin-notification-in-app-message (<= 2.0.60) that leads to RCE via PostgreSQL's COPY TO PROGRAM command. The exploit leverages unauthenticated account creation to bypass ACL restrictions and execute arbitrary commands as the postgres OS user.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H