Executive brief
NocoBase, an open-source no-code platform, contains a critical vulnerability in its in-app notification system. An attacker can exploit this to gain full control over the database and execute arbitrary commands on the underlying server. Because the platform allows public registration by default, any user on the internet can perform this attack to steal sensitive data or disrupt operations.
Technical details
A SQL injection vulnerability exists in the `latestMsgReceiveTimestamp` filter of the `/api/myInAppChannels:list` endpoint within the `@nocobase/plugin-notification-in-app-message` plugin. The root cause is the use of `Sequelize.literal()` with unescaped user input from the `$lt` query parameter. Since the underlying `pg` driver supports stacked statements and default Docker deployments configure the database user with superuser privileges, an attacker can use the `COPY ... TO PROGRAM` command to achieve remote code execution (RCE) as the postgres user. While the endpoint requires authentication, the default configuration allows anonymous sign-up, making the vulnerability reachable by any remote user. The issue is fixed in version 2.0.61.
Affected products
- NocoBase @nocobase/plugin-notification-in-app-message <= 2.0.60
Timeline
- 2026-06-11: disclosed
- 2026-07-15: advisory: NVD publication date
- 2026-07-31: patched: GitHub Advisory published/updated