Is CVE-2026-55410 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55410 being exploited in the wild.

How severe is CVE-2026-55410?

Medium severity, with a CVSS score of 6.7, published 15 July 2026.

Which products and versions are affected?

NocoBase Backups Plugin < 2.1.19; @nocobase/plugin-backups (npm) < 2.1.19, SEMVER:introduced=0,fixed=2.1.19.

Is there a fix for CVE-2026-55410?

Yes. @nocobase/plugin-backups (npm): upgrade to 2.1.19 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55410 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-55410?

Check whether you run NocoBase Backups Plugin or @nocobase/plugin-backups (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55410: NocoBase OS command injection in backup restore plugin

Q: Is there a fix for CVE-2026-55410?

Yes. @nocobase/plugin-backups (npm): upgrade to 2.1.19 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55410 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-55410?

Check whether you run NocoBase Backups Plugin or @nocobase/plugin-backups (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55410 · Severity: medium · CVSS 6.7 · Published 2026-07-15

NocoBase's backup restore feature allows database administrators and backup-management users to restore PostgreSQL database backups. When restoring a backup with forced schema override enabled, the plugin fails to sanitize the schema name from the backup metadata before passing it to a shell command, allowing an attacker with backup restore privileges to inject arbitrary shell commands that execute as the NocoBase server process. This could lead to unauthorized access to application secrets, data theft, or service disruption.

Vendors: NocoBase, npm.

Quick answers

Is CVE-2026-55410 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55410 being exploited in the wild.
How severe is CVE-2026-55410?: Medium severity, with a CVSS score of 6.7, published 15 July 2026.
Which products and versions are affected?: NocoBase Backups Plugin < 2.1.19; @nocobase/plugin-backups (npm) < 2.1.19, SEMVER:introduced=0,fixed=2.1.19.
Is there a fix for CVE-2026-55410?: Yes. @nocobase/plugin-backups (npm): upgrade to 2.1.19 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55410 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-55410?: Check whether you run NocoBase Backups Plugin or @nocobase/plugin-backups (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@nocobase/plugin-backups (npm): upgrade to 2.1.19 or later
```
npm install @nocobase/plugin-backups@2.1.19
```

Technical details

The vulnerability is a shell command injection in the PostgreSQL backup restore path. The RestoreManager reads backup metadata from _metadata.json and passes the database.schema field to PostgresAdapter.restore(). When forced schema restore is enabled (force=true), PostgresAdapter builds a pg_restore command by interpolating the schema name directly into a string (e.g., `-n ${srcSchema}`), then executes this string via child_process.exec(), which invokes a shell. A schema value like `safe; touch /tmp/marker #` terminates the pg_restore command with a semicolon and executes a second arbitrary command. The vulnerability requires backup restore privileges (backups:* / backup:* ACL) and is exploitable without a valid PostgreSQL connection or valid backup file. The patched version is 2.1.19; versions prior to that are affected.

Affected products

NocoBase @nocobase/plugin-backups < 2.1.19
NocoBase @nocobase/preset-nocobase < 2.1.19 (includes vulnerable plugin)

Identifiers

CVE-2026-55410
GHSA-p853-83gj-wjj3

Timeline

2026-06-12: disclosed
2026-08-20: advisory
2026-08-20: patched: Fixed in version 2.1.19

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.