CVE-2026-55410 Overview
CVE-2026-55410 is a command injection vulnerability [CWE-78] in NocoBase, an AI-powered no-code/low-code platform for building business applications. The flaw affects the @nocobase/plugin-backups component in versions prior to 2.1.19. During PostgreSQL backup restoration, the plugin interpolates the database.schema value from _metadata.json directly into shell command strings executed via Node.js child_process.exec(). A backup-management user who restores a crafted backup can execute arbitrary commands as the NocoBase server process. The vendor released a fix in version 2.1.19.
Critical Impact
Authenticated attackers with backup-management privileges can achieve arbitrary command execution on the host running the NocoBase server, leading to full compromise of application data and the server process context.
Affected Products
- NocoBase platform versions prior to 2.1.19
- @nocobase/plugin-backups component when used with PostgreSQL databases
- Deployments allowing user-supplied backup archive restoration
Discovery Timeline
- 2026-07-15 - CVE-2026-55410 published to NVD
- 2026-07-16 - Last updated in NVD database
Technical Details for CVE-2026-55410
Vulnerability Analysis
The vulnerability resides in the PostgreSQL restore workflow of the @nocobase/plugin-backups module. When restoring a backup archive, the plugin reads the _metadata.json file bundled inside the archive to determine the target database schema. The database.schema string is then concatenated into a shell command that invokes PostgreSQL utilities and passed to Node.js child_process.exec(). Because exec() spawns a shell to interpret its argument, any shell metacharacters present in the schema value are evaluated. An attacker uploading a crafted backup file can embed operating system commands within the schema field. The Common Weakness Enumeration classifies this as CWE-78, Improper Neutralization of Special Elements used in an OS Command.
Root Cause
The root cause is unsanitized interpolation of attacker-controllable metadata into a shell command string. The code path trusts values inside _metadata.json as safe identifiers rather than treating them as untrusted input. No escaping, allowlisting, or argument-array invocation was applied before reaching child_process.exec().
Attack Vector
Exploitation requires authenticated access as a backup-management user in NocoBase. The attacker crafts a backup archive containing a malicious _metadata.json with shell metacharacters, such as command substitution or chained commands, embedded in the database.schema field. When an administrator or the attacker restores this backup, the injected payload runs with the privileges of the NocoBase Node.js process. See the GitHub Security Advisory GHSA-p853-83gj-wjj3 for advisory details and the remediation commit for the code-level fix.
Detection Methods for CVE-2026-55410
Indicators of Compromise
- Unexpected child processes spawned by the NocoBase Node.js server, particularly shells (sh, bash) invoked outside normal backup workflows
- _metadata.json files inside uploaded backup archives containing shell metacharacters such as `, $(, ;, &&, or | in the database.schema field
- Outbound network connections from the NocoBase server host initiated shortly after a backup restore event
Detection Strategies
- Inspect backup archive contents before restore and validate that database.schema matches a strict identifier pattern (for example, ^[A-Za-z_][A-Za-z0-9_]*$)
- Monitor process trees for node parent processes spawning unexpected children during restore operations
- Correlate NocoBase application audit logs for backup restore actions with host-level process execution events
Monitoring Recommendations
- Enable verbose audit logging in NocoBase for backup upload and restore actions and forward these logs to a centralized SIEM
- Alert on any restore action performed by non-administrative accounts or from unusual source addresses
- Track file integrity of the @nocobase/plugin-backups directory to detect tampering with the plugin logic
How to Mitigate CVE-2026-55410
Immediate Actions Required
- Upgrade NocoBase to version 2.1.19 or later, which contains the official fix
- Audit all accounts with backup-management privileges and remove the role from users who do not require it
- Review recent backup restore activity for signs of exploitation and rotate credentials if compromise is suspected
Patch Information
The vulnerability is fixed in NocoBase 2.1.19. The remediation replaces unsafe string interpolation with safe argument handling when invoking PostgreSQL utilities. Details are available in the NocoBase v2.1.19 release notes and the GitHub commit implementing the fix.
Workarounds
- Restrict the backup-management role to trusted administrators only until the upgrade is applied
- Refuse restore of backup archives originating from outside the organization or from untrusted sources
- Run the NocoBase server process as a low-privilege system user to limit the blast radius of successful command injection
# Upgrade NocoBase to the patched release
npm install @nocobase/app@2.1.19
# Restart the NocoBase service after upgrade
systemctl restart nocobase
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
