Executive brief
NocoBase's backup restore feature allows database administrators and backup-management users to restore PostgreSQL database backups. When restoring a backup with forced schema override enabled, the plugin fails to sanitize the schema name from the backup metadata before passing it to a shell command, allowing an attacker with backup restore privileges to inject arbitrary shell commands that execute as the NocoBase server process. This could lead to unauthorized access to application secrets, data theft, or service disruption.
Technical details
The vulnerability is a shell command injection in the PostgreSQL backup restore path. The RestoreManager reads backup metadata from _metadata.json and passes the database.schema field to PostgresAdapter.restore(). When forced schema restore is enabled (force=true), PostgresAdapter builds a pg_restore command by interpolating the schema name directly into a string (e.g., `-n ${srcSchema}`), then executes this string via child_process.exec(), which invokes a shell. A schema value like `safe; touch /tmp/marker #` terminates the pg_restore command with a semicolon and executes a second arbitrary command. The vulnerability requires backup restore privileges (backups:* / backup:* ACL) and is exploitable without a valid PostgreSQL connection or valid backup file. The patched version is 2.1.19; versions prior to that are affected.
Affected products
- NocoBase @nocobase/plugin-backups < 2.1.19
- NocoBase @nocobase/preset-nocobase < 2.1.19 (includes vulnerable plugin)
Timeline
- 2026-06-12: disclosed
- 2026-08-20: advisory
- 2026-08-20: patched: Fixed in version 2.1.19