CVE-2026-52887 is a critical vulnerability affecting NocoBase versions prior to 2.0.61. The @nocobase/plugin-notification-in-app-message plugin improperly sanitizes the 'filter[latestMsgReceiveTimestamp][$lt]' parameter in the GET /api/myInAppChannels:list endpoint. By injecting malicious input into a Sequelize.literal() template string without proper escaping or parameter binding, authenticated users can execute stacked SQL statements. Attackers may leverage PostgreSQL's COPY ... TO PROGRAM functionality to execute arbitrary system commands. This affects all deployments of NocoBase platform versions before 2.0.61 using the vulnerable plugin. Exploitation requires user authentication but does not require administrative privileges. Successful attacks could lead to full database compromise, data exfiltration, or system-level code execution. Immediate mitigation requires upgrading to NocoBase 2.0.61 or later. No workarounds exist for this high-severity issue.