CVE-2026-55410

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.1.19, NocoBase @nocobase/plugin-backups restored PostgreSQL backups by interpolating the database.schema value from _metadata.json into shell command strings executed with Node.js child_process.exec(), allowing a backup-management user restoring a crafted backup to execute commands as the NocoBase server process. This vulnerability is fixed in 2.1.19.

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.1.19, NocoBase @nocobase/plugin-backups restored PostgreSQL backups by interpolating the database.schema value from _metadata.json into shell command strings executed with Node.js child_process.exec(), allowing a backup-management user restoring a crafted backup to execute commands as the NocoBase server process. This vulnerability is fixed in 2.1.19.

Summary

NocoBase @nocobase/plugin-backups 2.0.57 restores PostgreSQL backups by interpolating the backup metadata schema name into shell command strings that are executed with Node.js child_process.exec(). A backup-management user who can restore an uploaded PostgreSQL backup with forced schema restore can place shell metacharacters in _metadata.json under database.schema, causing arbitrary commands to execute as the NocoBase server process during restore.

The vulnerable plugin is included in the default @nocobase/preset-nocobase package and is guarded by the backup-management ACL snippet (backups:* / backup:*). This is not unauthenticated; the attacker must have backup restore privileges or equivalent access to the restore API/CLI.

Details

Affected product evidence:

• Ecosystem/package: npm package @nocobase/plugin-backups from packages/plugins/@nocobase/plugin-backups/package.json.
• Tested vulnerable version: 2.0.57 (packages/plugins/@nocobase/plugin-backups/package.json:1-16).
• Tested commit: e03d267362b3426f484c28783020b4a2a08911e8.
• Default/common inclusion: @nocobase/preset-nocobase depends on and lists @nocobase/plugin-backups 2.0.57 as built in (packages/presets/nocobase/package.json:22-24, packages/presets/nocobase/package.json:115-128).
• Affected range estimate: at least the tested 2.0.57 checkout. Earlier/later versions were not tested.
• Patched version: unknown/not available in this local checkout.

Source-to-sink path:

• The plugin registers backup-management snippets for backups:* and backup:*, so the restore API is intended for roles granted backup-management permissions (packages/plugins/@nocobase/plugin-backups/src/server/plugin.ts:51-59).
• The backup restore-upload action accepts request body/query force and passes it as forceSchemaRestore to RestoreManager.restore() (packages/plugins/@nocobase/plugin-backups/src/server/resourcers/backup-cli.ts:40-42, packages/plugins/@nocobase/plugin-backups/src/server/resourcers/backup-cli.ts:200-211).
• RestoreManager decompresses the uploaded backup archive, reads _metadata.json, and parses attacker-controlled JSON metadata (packages/plugins/@nocobase/plugin-backups/src/server/managers/restore.ts:203-215, packages/plugins/@nocobase/plugin-backups/src/server/managers/restore.ts:257-267).
• When forceSchemaRestore is true and the database dialect is PostgreSQL, the schema-mismatch check is skipped (packages/plugins/@nocobase/plugin-backups/src/server/managers/restore.ts:270-300). Existing tests confirm forced schema restore intentionally allows a metadata schema mismatch (packages/plugins/@nocobase/plugin-backups/src/server/__tests__/managers/restore.test.ts:336-356) and that the API passes forceSchemaRestore: true when force=true is supplied (packages/plugins/@nocobase/plugin-backups/src/server/__tests__/managers/restore.test.ts:377-409).
• The parsed metadata.database.schema is passed into this.#dbAdapter.restore(path.join(extractedDir, dbFile), metadata.database.schema) (packages/plugins/@nocobase/plugin-backups/src/server/managers/restore.ts:427-448).
• For PostgreSQL, if the backup schema differs from the target schema, PostgresAdapter.restore() assigns srcSchema = schema || 'public' and builds pgRestoreCommand using -n ${srcSchema} with no quoting or argument array (packages/plugins/@nocobase/plugin-backups/src/server/adapters/database.ts:350-420).
• #restoreSchema() also interpolates srcSchema and targetSchema directly into SQL strings and then calls run(pgRestoreCommand, ...) (packages/plugins/@nocobase/plugin-backups/src/server/adapters/database.ts:423-451).
• run() executes the assembled string through child_process.exec(), which invokes a shell (packages/plugins/@nocobase/plugin-backups/src/server/adapters/database.ts:1-31).

A schema value such as safe; touch /tmp/nocobase-cve-marker # produces a restore command of this form:

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.1.19, NocoBase @nocobase/plugin-backups restored PostgreSQL backups by interpolating the database.schema value from _metadata.json into shell command strings executed with Node.js child_process.exec(), allowing a backup-management user restoring a crafted backup to execute commands as the NocoBase server process. This vulnerability is fixed in 2.1.19.

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.1.19, NocoBase @nocobase/plugin-backups restored PostgreSQL backups by interpolating the database.schema value from _metadata.json into shell command strings executed with Node.js child_process.exec(), allowing a backup-management user restoring a crafted backup to execute commands as the NocoBase server process. This vulnerability is fixed in 2.1.19.

Summary

NocoBase @nocobase/plugin-backups 2.0.57 restores PostgreSQL backups by interpolating the backup metadata schema name into shell command strings that are executed with Node.js child_process.exec(). A backup-management user who can restore an uploaded PostgreSQL backup with forced schema restore can place shell metacharacters in _metadata.json under database.schema, causing arbitrary commands to execute as the NocoBase server process during restore.

The vulnerable plugin is included in the default @nocobase/preset-nocobase package and is guarded by the backup-management ACL snippet (backups:* / backup:*). This is not unauthenticated; the attacker must have backup restore privileges or equivalent access to the restore API/CLI.

Details

Affected product evidence:

• Ecosystem/package: npm package @nocobase/plugin-backups from packages/plugins/@nocobase/plugin-backups/package.json.
• Tested vulnerable version: 2.0.57 (packages/plugins/@nocobase/plugin-backups/package.json:1-16).
• Tested commit: e03d267362b3426f484c28783020b4a2a08911e8.
• Default/common inclusion: @nocobase/preset-nocobase depends on and lists @nocobase/plugin-backups 2.0.57 as built in (packages/presets/nocobase/package.json:22-24, packages/presets/nocobase/package.json:115-128).
• Affected range estimate: at least the tested 2.0.57 checkout. Earlier/later versions were not tested.
• Patched version: unknown/not available in this local checkout.

Source-to-sink path:

• The plugin registers backup-management snippets for backups:* and backup:*, so the restore API is intended for roles granted backup-management permissions (packages/plugins/@nocobase/plugin-backups/src/server/plugin.ts:51-59).
• The backup restore-upload action accepts request body/query force and passes it as forceSchemaRestore to RestoreManager.restore() (packages/plugins/@nocobase/plugin-backups/src/server/resourcers/backup-cli.ts:40-42, packages/plugins/@nocobase/plugin-backups/src/server/resourcers/backup-cli.ts:200-211).
• RestoreManager decompresses the uploaded backup archive, reads _metadata.json, and parses attacker-controlled JSON metadata (packages/plugins/@nocobase/plugin-backups/src/server/managers/restore.ts:203-215, packages/plugins/@nocobase/plugin-backups/src/server/managers/restore.ts:257-267).
• When forceSchemaRestore is true and the database dialect is PostgreSQL, the schema-mismatch check is skipped (packages/plugins/@nocobase/plugin-backups/src/server/managers/restore.ts:270-300). Existing tests confirm forced schema restore intentionally allows a metadata schema mismatch (packages/plugins/@nocobase/plugin-backups/src/server/__tests__/managers/restore.test.ts:336-356) and that the API passes forceSchemaRestore: true when force=true is supplied (packages/plugins/@nocobase/plugin-backups/src/server/__tests__/managers/restore.test.ts:377-409).
• The parsed metadata.database.schema is passed into this.#dbAdapter.restore(path.join(extractedDir, dbFile), metadata.database.schema) (packages/plugins/@nocobase/plugin-backups/src/server/managers/restore.ts:427-448).
• For PostgreSQL, if the backup schema differs from the target schema, PostgresAdapter.restore() assigns srcSchema = schema || 'public' and builds pgRestoreCommand using -n ${srcSchema} with no quoting or argument array (packages/plugins/@nocobase/plugin-backups/src/server/adapters/database.ts:350-420).
• #restoreSchema() also interpolates srcSchema and targetSchema directly into SQL strings and then calls run(pgRestoreCommand, ...) (packages/plugins/@nocobase/plugin-backups/src/server/adapters/database.ts:423-451).
• run() executes the assembled string through child_process.exec(), which invokes a shell (packages/plugins/@nocobase/plugin-backups/src/server/adapters/database.ts:1-31).

A schema value such as safe; touch /tmp/nocobase-cve-marker # produces a restore command of this form: