An authenticated user can exploit a SQL injection flaw in the GET /api/myInAppChannels:list endpoint of NocoBase caused by inserting the filter[latestMsgReceiveTimestamp][$lt] value directly into a Sequelize.literal() template string without proper escaping or parameter binding. Prior to version 2.0.61, this allowed stacked PostgreSQL statements to be run, potentially enabling execution of privileged commands such as COPY … TO PROGRAM. The vulnerability is a classic SQL injection (CWE‑89) and carries a CVSS score of 10, indicating a severe risk of remote code execution on the host system.

Any NocoBase installation using the @nocobase/plugin‑notification‑in‑app‑message before version 2.0.61 is affected. The fix was released in 2.0.61; earlier releases remain vulnerable.

The vulnerability presents a high‑severity attack surface, but the EPSS score of less than 1 % suggests that exploitation attempts have been rare to date. The flaw requires that an attacker be a signed‑up, authenticated user of the platform and that they can manipulate the filter query parameter; thus, the attack vector is an authenticated HTTP request. Although the flaw is not listed in CISA’s KEV catalog, its potential to execute commands on the host system makes it a critical threat for any deployment with permissive database access.