CVE-2026-52887
1 advisory.
npm/@nocobase/plugin-notification-in-app-message CVE-2026-52887: critical 10, EPSS 0.89%
NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE
Action: Upgrade @nocobase/plugin-notification-in-app-message to 2.0.61 or later.
npm i @nocobase/plugin-notification-in-app-message@2.0.61Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.0.61 | - |
Fixed versions
| 2.0.61 |
Sources
- osv: GHSA-p849-8hwh-84j9
- https://github.com/nocobase/nocobase/security/advisories/GHSA-p849-8hwh-84j9
- https://nvd.nist.gov/vuln/detail/CVE-2026-52887
- https://github.com/nocobase/nocobase/pull/9630
- https://github.com/nocobase/nocobase/commit/68d64e3fcfb8be2ae4f3bfc9e1ee3f85b87c89ce
- https://github.com/nocobase/nocobase
- https://github.com/nocobase/nocobase/releases/tag/v2.0.61
CVE-2026-52887 · published · modified · JSON