SQL Injection Vulnerability in NocoBase AI-Powered Platform
CVE-2026-52887
10CRITICAL
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-52887?
NocoBase, an AI-powered no-code/low-code platform, has a vulnerability in versions prior to 2.0.61 due to an improper handling of input parameters in the notification API. The GET request to /api/myInAppChannels:list allows authenticated users to inject unvalidated input into SQL commands. This oversight could enable attackers to execute arbitrary PostgreSQL commands and potentially gain unauthorized access to sensitive data. The issue is remediated in version 2.0.61.
Affected Version(s)
nocobase < 2.0.61
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.