https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 04:16:55 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-338891 EUVD-2026-338891 https://cve.radiocsirt.org/vuln/euvd-2026-338891 https://cve.radiocsirt.org/vuln/fkie_cve-2026-52887 <p>NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.0.61, NocoBase @nocobase/plugin-notification-in-app-message exposed GET /api/myInAppChannels:list, where the filter[latestMsgReceiveTimestamp][$lt] value was inserted into a Sequelize.literal() template string without escaping or parameter binding, allowing a signed-up authenticated user to run stacked PostgreSQL statements and potentially execute commands with COPY ... TO PROGRAM. This vulnerability is fixed in 2.0.61.</p> <p>NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.0.61, NocoBase @nocobase/plugin-notification-in-app-message exposed GET /api/myInAppChannels:list, where the filter[latestMsgReceiveTimestamp][$lt] value was inserted into a Sequelize.literal() template string without escaping or parameter binding, allowing a signed-up authenticated user to run stacked PostgreSQL statements and potentially execute commands with COPY ... TO PROGRAM. This vulnerability is fixed in 2.0.61.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-52887 https://cve.radiocsirt.org/vuln/ghsa-p849-8hwh-84j9 <p><strong>Affected:</strong> npm: @nocobase/plugin-notification-in-app-message</p> <p>## Summary</p> <p>`GET /api/myInAppChannels:list` accepts a structured `filter` query parameter. The handler for the `latestMsgReceiveTimestamp` field splices the `$lt` value directly into a `Sequelize.literal()` template string with no escape, type cast, or parameter binding. The action ACL is `loggedIn`, so any authenticated account reaches it. The default `auth-basic` authenticator ships `allowSignUp: true`, so the account is obtainable anonymously.</p> <p>The injection is reachable with the URL parameter `filter[latestMsgReceiveTimestamp][$lt]=&lt;expression&gt;`. The `pg` driver in front of Sequelize accepts stacked statements, so the chain extends from boolean and timing oracles to multi-statement payloads.</p> <p>The shipped `docker-compose.yml` creates the DB role `nocobase` on a stock `postgres:16` image, which assigns the `rolsuper` attribute by default. `COPY ... TO PROGRAM &#39;...&#39;` therefore runs shell commands as `uid=999(postgres)` inside the database container.</p> <p>Result: any anonymous visitor signs up, signs in, and exfiltrates arbitrary rows or executes shell commands inside the database container with one HTTP GET after the sign-in.</p> <p>## Affected</p> <p>NocoBase server, `@nocobase/plugin-notification-in-app-message` `&lt;=2.0.57`. Confirmed live-exploitable on the official `nocobase/nocobase:2.0.57` Docker image (HEAD `e35a2737d9df139cacecae0151c3326746e2339a`).</p> <p>`@nocobase/plugin-notification-in-app-message` is enabled by default in `@nocobase/preset-nocobase`. The default `auth-basic` ships `…</p> <p><strong>Affected:</strong> npm: @nocobase/plugin-notification-in-app-message</p> <p>## Summary</p> <p>`GET /api/myInAppChannels:list` accepts a structured `filter` query parameter. The handler for the `latestMsgReceiveTimestamp` field splices the `$lt` value directly into a `Sequelize.literal()` template string with no escape, type cast, or parameter binding. The action ACL is `loggedIn`, so any authenticated account reaches it. The default `auth-basic` authenticator ships `allowSignUp: true`, so the account is obtainable anonymously.</p> <p>The injection is reachable with the URL parameter `filter[latestMsgReceiveTimestamp][$lt]=&lt;expression&gt;`. The `pg` driver in front of Sequelize accepts stacked statements, so the chain extends from boolean and timing oracles to multi-statement payloads.</p> <p>The shipped `docker-compose.yml` creates the DB role `nocobase` on a stock `postgres:16` image, which assigns the `rolsuper` attribute by default. `COPY ... TO PROGRAM &#39;...&#39;` therefore runs shell commands as `uid=999(postgres)` inside the database container.</p> <p>Result: any anonymous visitor signs up, signs in, and exfiltrates arbitrary rows or executes shell commands inside the database container with one HTTP GET after the sign-in.</p> <p>## Affected</p> <p>NocoBase server, `@nocobase/plugin-notification-in-app-message` `&lt;=2.0.57`. Confirmed live-exploitable on the official `nocobase/nocobase:2.0.57` Docker image (HEAD `e35a2737d9df139cacecae0151c3326746e2339a`).</p> <p>`@nocobase/plugin-notification-in-app-message` is enabled by default in `@nocobase/preset-nocobase`. The default `auth-basic` ships `…</p> https://cve.radiocsirt.org/vuln/ghsa-p849-8hwh-84j9