TI-2026-39980 Aliases CVE-2026-55410 GHSA-p853-83gj-wjj3

NocoBase backup restore schema name allows command injection

MEDIUM 63CWE-78Published 2026-07-15 · Updated 2026-07-18

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: Low · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-78.

Summary

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.1.19, NocoBase @nocobase/plugin-backups restored PostgreSQL backups by interpolating the database.schema value from _metadata.json into shell command strings executed with Node.js child_process.exec(), allowing a backup-management user restoring a crafted backup to execute commands as the NocoBase server process. This vulnerability is fixed in 2.1.19.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00721 54th percentileScored 2026-11-07

Fix Fixed nocobase (nocobase): 2.1.19@nocobase/plugin-backups (npm): 2.1.19

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
nocobase	nocobase	before 2.1.19	2.1.19	Patch available	CNA
—	@nocobase/plugin-backups (npm)	before 2.1.19	2.1.19	Patch available	GHSA-p853-83gj-wjj3

nocobase Vendornocobase Affected before 2.1.19 Fixed in 2.1.19 Patch available CNA
@nocobase/plugin-backups (npm) Vendor— Affected before 2.1.19 Fixed in 2.1.19 Patch available GHSA-p853-83gj-wjj3

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:nocobase:nocobase::::::::	—	—	nocobase

cpe:2.3:a:nocobase:nocobase:*:*:*:*:*:*:*:* Versions — — ·nocobase

Remediation

Fix · CNA nocobase (nocobase) Fixed in 2.1.19
Fix · GHSA-p853-83gj-wjj3 @nocobase/plugin-backups (npm) Fixed in 2.1.19 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-55410
2026-10-03 Alias added: GHSA-p853-83gj-wjj3

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-55410

Other 4

TI-2026-37983 NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE CVSS 3.1CRITICAL 10.0
TI-2026-26457 NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node CVSS 3.1CRITICAL 10.0
TI-2026-27069 NocoBase Has SQL Injection via template variable substitution in workflow SQL node CVSS 4.0HIGH 8.5
TI-2026-30159 NocoBase Vulnerable to SQL Injection via String Concatenation in Recursive Eager Loading CVSS 3.1HIGH 8.8
TI-2026-05461 nocobase plugin-workflow-javascript Vm.js createSafeConsole sandbox CVSS 4.0MEDIUM 6.9
TI-2026-30160 NocoBase Vulnerable to SQL Validation Bypass via `sqlCollection:update` Missing `checkSQL` Call CVSS 3.1HIGH 7.2

See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences