CVE-2026-55410

NocoBase backup restore schema name allows command injection

Published

2026-08-20

Modified

2026-08-20

EPSS percentile

30%

Aliases

GHSA-p853-83gj-wjj3

Sources

github-advisory

Summary

### Summary NocoBase `@nocobase/plugin-backups` 2.0.57 restores PostgreSQL backups by interpolating the backup metadata schema name into shell command strings that are executed with Node.js `child_process.exec()`. A backup-management user who can restore an uploaded PostgreSQL backup with forced schema restore can place shell metacharacters in `_metadata.json` under `database.schema`, causing arbitrary commands to execute as the NocoBase server process during restore. The vulnerable plugin is included in the default `@nocobase/preset-nocobase` package and is guarded by the backup-management ACL snippet (`backups:*` / `backup:*`). This is not unauthenticated; the attacker must have backup restore privileges or equivalent access to the restore API/CLI. ### Details Affected product evidence: - Ecosystem/package: npm package `@nocobase/plugin-backups` from `packages/plugins/@nocobase/plugin-backups/package.json`. - Tested vulnerable version: `2.0.57` (`packages/plugins/@nocobase/plugin-backups/package.json:1-16`). - Tested commit: `e03d267362b3426f484c28783020b4a2a08911e8`. - Default/common inclusion: `@nocobase/preset-nocobase` depends on and lists `@nocobase/plugin-backups` 2.0.57 as built in (`packages/presets/nocobase/package.json:22-24`, `packages/presets/nocobase/package.json:115-128`). - Affected range estimate: at least the tested `2.0.57` checkout. Earlier/later versions were not tested. - Patched version: unknown/not available in this local checkout. Source-to-sink path: - The plugin registers backup-management snippets for `backups:*` and `backup:*`, so the restore API is intended for roles granted backup-management permissions (`packages/plugins/@nocobase/plugin-backups/src/server/plugin.ts:51-59`). - The `backup` restore-upload action accepts request body/query `force` and passes it as `forceSchemaRestore` to `RestoreManager.restore()` (`packages/plugins/@nocobase/plugin-backups/src/server/resourcers/backup-cli.ts:40-42`, `packages/plugins/@nocobase/plugin-backups/src/server/resourcers/backup-cli.ts:200-211`). - `RestoreManager` decompresses the uploaded backup archive, reads `_metadata.json`, and parses attacker-controlled JSON metadata (`packages/plugins/@nocobase/plugin-backups/src/server/managers/restore.ts:203-215`, `packages/plugins/@nocobase/plugin-backups/src/server/managers/restore.ts:257-267`). - When `forceSchemaRestore` is true and the database dialect is PostgreSQL, the schema-mismatch check is skipped (`packages/plugins/@nocobase/plugin-backups/src/server/managers/restore.ts:270-300`). Existing tests confirm forced schema restore intentionally allows a metadata schema mismatch (`packages/plugins/@nocobase/plugin-backups/src/server/__tests__/managers/restore.test.ts:336-356`) and that the API passes `forceSchemaRestore: true` when `force=true` is supplied (`packages/plugins/@nocobase/plugin-backups/src/server/__tests__/managers/restore.test.ts:377-409`). - The parsed `metadata.database.schema` is passed into `this.#dbAdapter.restore(path.join(extractedDir, dbFile), metadata.database.schema)` (`packages/plugins/@nocobase/plugin-backups/src/server/managers/restore.ts:427-448`). - For PostgreSQL, if the backup schema differs from the target schema, `PostgresAdapter.restore()` assigns `srcSchema = schema || 'public'` and builds `pgRestoreCommand` using `-n ${srcSchema}` with no quoting or argument array (`packages/plugins/@nocobase/plugin-backups/src/server/adapters/database.ts:350-420`). - `#restoreSchema()` also interpolates `srcSchema` and `targetSchema` directly into SQL strings and then calls `run(pgRestoreCommand, ...)` (`packages/plugins/@nocobase/plugin-backups/src/server/adapters/database.ts:423-451`). - `run()` executes the assembled string through `child_process.exec()`, which invokes a shell (`packages/plugins/@nocobase/plugin-backups/src/server/adapters/database.ts:1-31`). A schema value such as `safe; touch /tmp/nocobase-cve-marker #` produces a restore command of this form: ```text pg_rest

Affected packages

Remediation: Upgrade to 2.1.19 or later.

References

• https://github.com/advisories/GHSA-p853-83gj-wjj3