CVE-2026-52887: Critical SQL Injection and Remote Code Execution in NocoBase

NocoBase is an open-source, AI-powered no-code and low-code platform designed to build business applications and internal tools. The application architecture relies on a modular plugin system to provide core features, including user management, workflows, and notifications. The vulnerability resides specifically within the @nocobase/plugin-notification-in-app-message plugin, which handles in-app notification channels and messaging capabilities.

This plugin exposes a resource action handler called defineMyInAppChannels, which is routed to the HTTP endpoint GET /api/myInAppChannels:list. This endpoint is designed to allow users to retrieve lists of notification channels, applying server-side filters such as timestamps. Because this endpoint handles notifications, it is exposed to authenticated (signed-up) platform users, creating an internal attack surface.

The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). Input supplied to the query filters is evaluated in an unsafe raw SQL context. An attacker who has achieved standard user registration on a NocoBase deployment can exploit this flaw to execute arbitrary database queries, bypass security boundaries, and gain complete control over the underlying PostgreSQL server.

The root cause of CVE-2026-52887 lies in the insecure configuration and utilization of the Sequelize Object-Relational Mapper (ORM). When building relational queries in Sequelize, developers can use abstraction structures like operators (e.g., Op.and, Op.or, Op.lt) or direct queries. However, when complex database-specific functionality is required, developers often resort to using the Sequelize.literal() function.

The Sequelize.literal() function is designed to insert raw SQL fragments directly into the query generator. Because Sequelize treats the input of Sequelize.literal() as trusted developer-defined code, it completely bypasses the built-in sanitization, quoting, and parameterized binding mechanisms. Any string passed into this function is directly concatenated into the final SQL query sent to the database backend.

In the affected versions of NocoBase, the backend extracts query filters directly from the HTTP query parameters using the context action: const { filter = {}, limit = 30 } = ctx.action?.params ?? {};. When processing the filter[latestMsgReceiveTimestamp][$lt] parameter, the application attempts to filter messages by a specified cut-off timestamp. The code checks for the existence of this key and interpolates the raw, unvalidated string directly into the template literal passed to Sequelize.literal(). This direct interpolation merges user input with SQL commands before execution, resulting in an SQL injection vulnerability.

An analysis of the source code changes in commit 68d64e3fcfb8be2ae4f3bfc9e1ee3f85b87c89ce highlights the exact location of the security flaw and the engineering changes applied to fix it.

Prior to the security patch, the query filter for the timestamp was constructed dynamically using raw string template interpolation:

// VULNERABLE CODE
const latestMsgReceiveTSFilter = filter?.latestMsgReceiveTimestamp?.$lt
  ? Sequelize.literal(`${latestMsgReceiveTimestampSQL} < ${filter.latestMsgReceiveTimestamp.$lt}`)
  : null;

In the vulnerable implementation above, if the client sends a request containing filter[latestMsgReceiveTimestamp][$lt]=1) OR 1=1 --, the string is appended directly to the SQL fragment. This alters the query logic, allowing attackers to access unauthorized resources or execute stacked commands.

The patch addresses this vulnerability by introducing strict schema enforcement and refactoring the query interface to use standard Sequelize validation rules and parameter binding:

// SECURE PATCH IMPLEMENTATION
function parseLatestMsgReceiveTimestampLt(filter: unknown) {
  const latestMsgReceiveTimestamp =
    typeof filter === 'object' && filter !== null
      ? (filter as { latestMsgReceiveTimestamp?: unknown }).latestMsgReceiveTimestamp
      : null;
  if (
    typeof latestMsgReceiveTimestamp !== 'object' ||
    latestMsgReceiveTimestamp === null ||
    !Object.prototype.hasOwnProperty.call(latestMsgReceiveTimestamp, '$lt')
  ) {
    return null;
  }
 
  const value = (latestMsgReceiveTimestamp as { $lt?: unknown }).$lt;
  if (typeof value === 'string' && value.trim() === '') {
    throw new Error('Invalid latest message receive timestamp filter');
  }
  if (typeof value !== 'number' && typeof value !== 'string') {
    throw new Error('Invalid latest message receive timestamp filter');
  }
 
  const timestamp = Number(value);
  if (!Number.isFinite(timestamp)) {
    throw new Error('Invalid latest message receive timestamp filter');
  }
 
  return timestamp;
}

Additionally, the patch replaces the Sequelize.literal() comparison with an explicit Sequelize operator construct:

// SECURE PATCH IMPLEMENTATION (FILTER GENERATION)
const latestMsgReceiveTSFilter =
  latestMsgReceiveTimestampLt !== null
    ? Sequelize.where(Sequelize.literal(latestMsgReceiveTimestampSQL), Op.lt, latestMsgReceiveTimestampLt)
    : null;

By leveraging Sequelize.where combined with Op.lt, the application safely maps the strictly-validated floating point number latestMsgReceiveTimestampLt to a bound database parameter. Because the database driver executes this as a prepared parameter, the input is never evaluated as raw SQL. The remediation is highly complete because the type-casting helper actively rejects non-numeric strings, blocking any payload containing SQL syntax.

To successfully exploit this vulnerability, an attacker requires network access to the NocoBase API endpoint and valid session credentials. In many default NocoBase deployments, public user registration is enabled, allowing anyone to register a basic account and acquire an active JSON Web Token (JWT) session.

The attack begins by crafting an HTTP GET request targeting /api/myInAppChannels:list with an engineered filter query parameter. Since the database engine behind NocoBase is typically PostgreSQL, and the Node.js database connector (node-pg) permits stacked queries by default, statements can be chained using a semicolon.

An attacker can execute administrative tasks or shell commands on the server by leveraging PostgreSQL's COPY ... TO PROGRAM directive. This command spawns an OS shell and executes arbitrary commands as the database runtime user. The following payload sequence illustrates this attack pathway:

GET /api/myInAppChannels:list?filter[latestMsgReceiveTimestamp][$lt]=1); COPY (SELECT 'exploit') TO PROGRAM 'id' -- HTTP/1.1
Host: target-nocobase.local
Authorization: Bearer <JWT_TOKEN>

If the database connection possesses sufficient privileges (which is common in containerized environments where the database user is configured as postgres or superuser), the injected OS command executes within the context of the database container, leading to Remote Code Execution.

The technical impact of CVE-2026-52887 is evaluated as Critical, carrying a maximum CVSS v3.1 Base Score of 10.0. The vulnerability allows an authenticated attacker to execute arbitrary command structures inside the environment, resulting in a total compromise of confidentiality, integrity, and availability.

While the CVSS vector assigns 'Privileges Required: None' in some databases, the vulnerability requires authenticated access. However, because self-registration is often exposed on low-code platforms, this prerequisite is easily satisfied. The scope is defined as Changed (S:C) because exploitation allows an attacker to transition from the application database security context directly to the container's operating system environment.

In deployments utilizing standard Docker Compose files, the PostgreSQL process frequently runs with administrative privileges. This design flaw allows an attacker to compromise the entire container network, extract database credentials, manipulate application source files, or initiate lateral movement into the cloud hosting environment.

The primary defense against CVE-2026-52887 is updating NocoBase to version 2.0.61 or later, which incorporates the structural type validation and parameter binding patches. If an immediate upgrade is not feasible, several defensive controls can be implemented to mitigate risk.

First, restrict PostgreSQL database permissions. Ensure the database user used by NocoBase is not configured with SUPERUSER privileges. Execute the following SQL commands to revoke dangerous execution permissions from application databases:

ALTER USER nocobase WITH NOSUPERUSER;
REVOKE EXECUTE ON FUNCTION pg_read_file(text) FROM public;
REVOKE EXECUTE ON FUNCTION pg_write_file(text, text, boolean) FROM public;

Second, deploy Web Application Firewall (WAF) rules to inspect incoming query parameters on the affected endpoint. The following ModSecurity rule can be utilized to block malicious patterns in the timestamp filter:

SecRule REQUEST_FILENAME "@rx /api/myInAppChannels:list" \
    "id:100001,phase:2,deny,status:400,log,msg:'Block SQLi in myInAppChannels Filter',\
    chain"
    SecRule ARGS:filter[latestMsgReceiveTimestamp][$lt] "@rx [^0-9]" "t:none"

Implementing these controls reduces the attack surface, preventing exploitation of raw string interpolation before a platform-wide patch is applied.